I manage newgrounds.com which gets quite a bit of traffic. We'll get what I think are DDoS attacks at least once a month. I can see our connection tracking stats go up to the millions and traffic spikes way up of course.

I don't know WHY they do this, but last time it happened we got an abuse report saying that we were reported for port scanning from our main firewall / proxy box. Somehow they had reflected traffic off our firewall / proxy to make it try to connect to a bunch of IPs on a known trojan port.

I have no idea how they did this, but it appears that this time around we were being used to scan ports. This is just a stock Debian box with a firewall and port 80 open. Scary.