DDOS events typically use distributed botnets. Unless you analyze the CNC you’re probably asking for wide deployment of acls (flow spec or otherwise); and such agreements happen occasionally, as they operationally brutal but are slow (otherwise they would be subject to abuse).

You, right now, may be participating in a DDOS attack without knowing it. Should your ISP cut you off based on information from some Belgian ISP?