The attack looks like a layer 7 flood of HTTP requests with random but normal looking user agents. It is being mitigated using the firewall IP block in my specific case as the person is using a single specific dedicated machine.

I was also pretty surprised to hear that these requests also count towards bandwidth billing.