Yesterday, I got an email from my Service Provider that my server was targetted specifically in a DDoS attack. To prevent it from effecting their other customers, all traffic to the server was (temporarily) blocked.
Now, things seem to have normalized again, slightly.
I did some checking and there have been a huge number of attempted logins into the server (not in the game, but to the server itself) from a wide variety of ip addresses. In fact, those attempts are still ongoing, about every few seconds.
To the best of my knowledge, since the new install and the change of software stack, the attempts have all failed.
This might be a last desperate effort from the people who inserted the Advertising IFrame when my server was still vulnerable, but who knows?