good question. there's a fine line between using a VPS for DDoS and running a legitimate benchmark, installing software, updates, etc.
for me, the fun one is
UNREPLIED conntrack sessions (DoS attack/OUT)
default setting is
Suspend VPS if it spawns over 20000 unreplied conntrack sessions
as...