It's not actually as simple as that. As I'm sure you can imagine, there are variables beyond the control of a specific server provider or datacenter. Network routing is complicated. A DDOS can target the source or destination of a service's users.

When you see a sudden drop in the number of p2p connections it isn't obvious what the cause is, once you eliminate your own server as the cause (was it rebooted, did you forget to pay your server bill, did logs fill the disk and similar "internal" problems under the control of the witness).