It shouldnt be that confusing if they are using the Webscreen DDoS tool (and it works as well as they say it does). Unless they are looking for it they wont even know they are being attacked by a DDoS.