In a ddos situation, the communication between server and browser is unreliable at best. What I meant was a signal from your servers/load balancer to the ISP, which can then react by switching to more restrictive filtering for your IPs. It would be a small part of the solution when a perfect solution doesn't exist anyway.
Such a mechanism doesn't exist, and bad ISPs will ignore it anyway. There exists a mechanism called "abuse reporting", which sends an email to the ISP, so they can investigate, which will never happen.
I can just drop packets at our server's NIC, so they consume as little CPU time as possible. If that's not enough, I can talk to our ISP and get certain IPs/IP ranges/ASNs nullrouted. For very big attacks, see what
@Solaris17 wrote.
Hmm... CAPTCHA implementation after a certain number of requests / minute?
Yeah that's one option, and usually ends up with "more requests" (so our requests/minute counting overwhelms the CPU), or more IPs (so they can run at "max requests per minute minus one").
DDOS is basically a cat and mouse game, but I see no reason to invest hours of my time, when they take us down for minutes only