If the ddos attacks are mostly to the login endpoint
(which it makes sense, since the password is hashed heavily and even the check is computationally intensive)
A captcha to the login could mitigate this issue:
username: player
password: 54321
What is 3 minus 1?
captcha: 2
If that screen is ...