My second thought was utilizing some nodejs express reverse proxy -- with some kind of rate limiting slow down, but the attack stopped and I moved on to something else.