The longer it runs, the probability of identification increases. Save logs/timestamps, work with cloudfare, open an investigation.
This is the real botnet - fuckers DDOS, search timestamps with various IRC/discord/facebook, use timestamps to filter hits on hacker/leftist group sites/chatrooms. They have to recruit somewhere to aim more agents at the target. Some is OOB using already infected unsuspecting drones, but as nodes get pruned, others need to be solicited, in the open.