An orchestrated DDoS attack affected our systems on Feb 29th 2024, starting at 19:41UTC and ending 22:17 UTC.  We responded to the event and identified several IP addresses accessing data on one of our customers' public facing sites at extreme volume and rate.  Each series of requests per IP address were just under our WAF filtering volume / minute threshold so we started manually mitigating the situation. 

We were able to identify a single J3 fingerprint which allowed us to block all the inbound traffic from the suspected botnet allowing site performance to return to normal.  After monitoring the situation for another hour or so and verifying with impacted customers we closed the incident as resolved.  Further investigation showed that the J3 fingerprint continues to block traffic and is remaining in place.