The miscreants DDOSed right back, X100, and he lost his entire site.
I'd gently suggest against bear-poking.
How did they know who was behind the ddos?
Not sure. It was many moons ago, and he recounted it to me, so I did not observe it, myself. At that time, DDOS was still a fairly new (and highly effective) technique.
Slightly different context. They were exfiltrating data from his site, as opposed to completely cloning it.
Via a link posted here, perhaps. A "soft" DDOS, if you will.
I feel like in a race to the bottom we have the most to lose. Both reputationally, and as like a real company with assets worth suing for.