I worked for a Company that was a vendor for Lenovo. They had some sort of "News about Lenovo" app on all of their commercial grade machines. The content and translations were managed in our system and each computer would pull down the feed from our servers. It was decent traffic, but nothing crazy... Until they made a change and all of the sudden every machine was pulling every hour at zero minutes and zero seconds. We had one minute of DDoS every day at noon for about a week until that was mitigated.