Sounds about right - I'm amused that whoever saw this thought it was a ddos though.
dessalines - if you're reading this - I expect looking at referrers would be a good way to (manually) diagnose real attacks vs people becoming interested in your site.