We have tested this PR on our Civi 5.69.2 and unfortunately we are getting the exact same error logged. Apologies for the delayed response. Thank you for the suggested fix though, we will keep digging!

I will look into options to rate-limit the frequency which the page can be served all-together. This will need to be purely based on page loads, since we don't want to require login and the attackers rotated IPs. That may prove a little blunt but we don't receive a high frequency of simultaneously donations anyway. Thank you!

Setting a minimum donation is a great idea, had not considered that but every charge was exactly $2, so that would have helped at least prevent the transactions from reaching Stripe. Thank you!

Good to know! Even if we were Drupal and used the CiviWebform Integration, I suspect that type of user/IP blocking would not have worked in this case, as the page does not require login and the user was rotating IPs with each request. Seems like we need a solution that isn't IP-based.

Thanks! We will check that out. We do use the Joomla Extension "Admin Tools Professional" akeeba.com/products/admin-tools.html, which includes a firewall feature we do have deployed. However, we aren't aware of any features in that extension that would help in this situation, as the attacker was rotating multiple-thousand IPs per hour.