It depends. A CDN-like approach wouldn't really work because all requests are different and legit, so plain old caching isn't going to cut it.

On the other hand, Cloudflare has quite some experience with DDoS protection, so they definitely have the right infrastructure in place to stop this kind of abuse. What is the bill going to be, though?