DDOS attacks have happening a lot in the past months, this is something we had to mitigate and have been doing for a while now. We automatically block thousands of IP addresses, from know botnet IP's. But additionally we're blocking IP addresses which display strange behaviour.
Over the past months we were experiencing more and more issues with our old calendarserver (https://calendar.soverin.net:8443), which was clearly showing it's age.