I'm sure they could differentiate the hug of death due to sudden popularity vs the continued onslaught of scripted bots just by frequency of requests, right? As in, single IP frequency of pings measured out across a batch of addresses. Those malicious would be more regimented with short recycle times, while those unmalicious would be browsing making their repeated calls erratic. (Honest question, I'm genuinely curious.)

DDoS attacks need infected computers (and I'm not sure those would be hiding anywhere), so I would imagine that the logs from one DDoS attack would have a lot of the same IP entries as other DDoS attacks.

Same. I'm sure they're seeing a lot of traffic just out of support, curiosity, etc. Definitely would be interesting to know how they distinguish that from an attack.