They just need to hit you over a longer time scale and avoid making obvious peaks so that you can’t ask for the DDoS refund.