Since we now and receive feedback, the example, the name "DDoS" is wrong at a single IP address, here a short explanation why the name is correct:
In a single domain or IP address to access a lot of different IP addresses (DDoS). These are with fail2ban on certain characteristics such as specific user agent (Firefox 1.x, 2.x) or specific URL Views: domain.tld / file-there-nicht.txt determined and locked.
These are then more than (default) reportet 4 views of us.
From the point of view of the recipient of the reports, it looks like a DOS (since only one IP has been reported). From the perspective of the affected server, it is of course a DDOS.
Love Recipient of a ApacheDDOS -Report: please review the clients, since these infected with a trojan and are part of a botnet.
These are IP addresses which create honeypot forums, wikis or honeypot honeypot domains with guestbooks or comment function entries, which other URL's (buy Viagra ....) Bespammen.
Here many comments to be made manually via VPN service.
And yes, a comment in a blog, for example:
[url=http://www.tramadol2011.co.cc]morphine tramadol dosage equivalent[/url]
Is just as bad as SPAM!
These are main messages through already multiple 5xx messages.
If a mail server hard error such as the following does not understand, this is configured incorrectly or a bot:
Mar 13 10:14:03 server5 postfix/smtpd: NOQUEUE: reject: RCPT from unknown[126.96.36.199]: 554 5.7.1 Service unavailable; Client host [188.8.131.52] blocked using xbl.spamhaus.org; http://www.spamhaus.org/query/bl?ip=184.108.40.206; from=<anwalttzv @gmx.de> to=<firstname.lastname@example.org> proto=SMTP helo=<gmx.de>
And even if this acceptance of the spam mail was suppressed, the PC / server is still infected and sends it to another server, which is not spamhaus.org employs a spam mail!
On the pages is written in h2, which are all registrations and postings Reported. Most IP addresses are also on http://stopforumspam.com listed and are passed on to SFS.