DDoS for hire services are absolutely capable of that volume of traffic. Anyone willing and able to pay could be behind it. It costs less than you might guess. So who has a history of getting busted for anti-social attacks against nostr and related services?