Our websites have been the target of an increasing DDoS, the reason is unknown. Right now, we have taken enough precautions to reliably identify and filter the problematic requests (approx 1 mio/day at its peak, before we stopped counting). But as there were other efforts to disrupt our service in recurring intervals in the past and the attacks seem related, I wonder what else we could do.
The IPs are obviously just some botnet on consumer devices (DSL connections around the world etc., not TOR nodes), so I even if we started sending out abuse emails, it would not really make a difference, as the IPs are frequently changing. The attacker also does not seem to really care that the attack is no longer generating any deteriotion on our service, but it has been going on for more than a week now.
What should be our next step, while the attack is still ongoing, but is not harming us? Collect the IP adresses and report them somewhere? Handle the problematic requests in a special way in order to reduce the harm of the botnet to others? Anything to identify who is behind it, or why the site is being attacked?
In other words, right now we can gather information, if the next wave is better we might not be able to do it in such a reliable way. Can we do anything now?