It was an intermittent DDoS. We spent a good amount of time working around it, we haven't even tapped into 20% of the reserved server pool capacity yet and after throwing 20 more CPU cores at the front-end servers and some optimization here and there the DDoS lost its teeth.
Just hope this isn't goodbye already :/