Hey, another sw engineer here few out of the box suggestions, I bet they abuse syn packets if they target auth server. Maybe a simple throtling like:
Limit the number of connection attempts (SYNs) per IP per minute. Legitimate players only connect once or few times during a login attempt. If they ...