Originally Posted by Paz

If you're on a vps you can shell in during the attack and look for signatures of different DDOS attacks; https://www.iplocation.net/denial-of-service

Most of these attacks come from the Tor network. I found a script that pulls a list of Tor IPs and blocks them in IPTables. That pulls a list every 15 mins via a CRON job.