Glad it's back, probably you should check for useragent if it's a weak ddos attack.
Attacks these days are getting rather sophisticated, where significant amount of attacks are using javascript enabled headless browsers. (http://www.darkreading.com/attacks-breaches/ddos-attack-used...)