@utzer what is the user agents, looking at your access server logs, you should be able to see if even you had 1million different ip hitting at the same time, if all the user agents are the same, then you have trace back all million ip between whois and dig, to figure out if they are tied together, if all same user agent and time each ip hit and pulls same amount of data, that leans more to coordinated DDoS, if differing user agents, differing hit times and data captures, then massive scraping
did I make any sense