I think the hardware platform is not really interesting, as the DDOS was only caused by the worker pool of Apache2 being too small. Each hit of the site creates about 30 additional request for css,js,png and gif files. So 9000 hits in 3h mean something like 270.000 requests in 3h. Apparently this was too much for 50 workers.