I don't think it's a real DDoS. It's just a normal DDoS by the people who want to visit the website. If 30% of them are hammering on F5 because the website isn't loading, you have a DDos. Their servers just can't handle all visitors, that's what I think. It's easier to tell us, that some bad DDoSers are in charge of the downtime, than tell your customers that your system just can't handle it.