Thanks for your update, Neil. We tried switching IPs during the attack to the IP we run our backup server on, but the attack followed the domain name rather than the IP.