I think it's time to allow only client based log-ins only or make it mandatory to download the client to log-in. it will actually allow the loyal players to log in and play instead of wasting of days of membership that we all know you will not refund.
It wasn't so bad when the DDoS attacks were less than a minute. Your servers have been consistently down for over an hour now and your 30 minute death timers are irrevelant at this point. As Dharmaa said, it's appalling that you can't protect against this.