As others have noted, it may not even be a malicious, targeted attack - just the side effect of other spamming or careless crawling/scraping. Reviewing your ful

As others have noted, it may not even be a malicious, targeted attack - just the side effect of other spamming or careless crawling/scraping. Reviewing your full logs, and comparing current traffic/behavior with 'normal' periods, may help further characterize what's happening. There's a presentation called "Running At 99 Percent: Surviving an Application DoS" by Ryan Huber that may be helpful. (Slides and video from a number of conference presentations can be found via a search on that title.) It highlights some of the ways even a trickle of the wrong kind of app-specific traffic can be enough to bottleneck weak points in your app... and talks about mitigation ideas, both as a matter of good design and emergency request-filtering via server-side tools.