If the ddos attacks are mostly to the login endpoint
(which it makes sense, since the password is hashed heavily and even the check is computationally intensive)
A captcha to the login could mitigate this issue:
username: player
password: 54321
What is 3 minus 1?
captcha: 2
If that screen is impossible to edit, we could suffix our login name (or password) with the captcha:
e.g.:
login name: player
captcha: what is 3 minus 1
username: player2
password: 54321
OR
username: player
password: 543212
wdyt?