I feel your pain, recently had something similar happen that forced a website I run behind cloudflare, there isn't much you can do when you get millions of requests in a day from tens of thousands of US IPv4 addresses that are on the residential networks you see non-malicious traffic from.
One thing that got me was seeing some of the malicious traffic originate from the same /24 as I use at home. Whatever botnet was being used certainly has good penetration of residential ISPs in the US!
One thing that got me was seeing some of the malicious traffic originate from the same /24 as I use at home. Whatever botnet was being used certainly has good penetration of residential ISPs in the US!