In response to post #8467923. #8468158, #8468567, #8468831, #8469176, #8469446, #8469778 are all replies on the same post.
semi big sites are possibly just a test target, could be random. former site i moderated [acct namesake is the former domain name]. dos deflate is what we used to ignore odd request from IPs asking a odd request [one particular jpeg to the php design borders] with 15-100 connections.. in an attempt to flood the server and lag it slow to effectively "not respond" to newer legitimate users browsing the site. These DDoS'ers most likely are testing and updating their scripts for a much bigger target. our servers at web-tech-hosting seen waves of 300, 400, etc totalling up to 1000-3000 at a time... months prior to same attacks Google saw in 2007, 2008, 2009. the annoyance if anything is tweaking anti-ddos protections to know attacks from a regular visitor/user with possibly a weak connection and frustration of its user constantly refreshing [resending request], and safelisting known user IPs temp banned by the server.