What DDoS mitigation service were you using? This is why you need a provider like Incapsula, that protects at the origin server & C-name. Many providers only protect at the level of the A name, so you can get this kind of hit.