We have rate limited the port that is having the attacks at the moment and seems to have throttled them back some so not really impacting network, but still some servers working on tracing all down.
We have tracked it down to possibly web2/4 server, but it is impacting some others on that node as well cl2 mysql1/2 and cl2 web2/4 also live chat at the moment, we are working to resolve ASAP.