It could be for something like this: http://arstechnica.com/security/2015/04/ddos-attacks-that-cr...