If you're on a vps you can shell in during the attack and look for signatures of different DDOS attacks;
https://www.iplocation.net/denial-of-service
Most of these attacks come from the Tor network. I found a script that pulls a list of Tor IPs and blocks them in IPTables. That pulls a list every 15 mins via a CRON job.