are they flooding the pipe simply with gigabits / packets per second, or are requests coming through from too many IP addresses which causes too high a cpu load in request processing?
It sounds like the latter, in which case I don't understand why not block the entire autonomous system temporarily (while this is figured out)