I just went through all of this last week as my server was his by a DDoS, I practically created a tool kit, and wrote my own apache module tailored(which I may end up publishing the source if needed.) to my own needs. I would love to hear someone else's methods, but here is what you can easily setup:
Limit the amount of inbound connections coming in to your webserver, KeepAlive should be enabled on apache by default. This will limit your inbound tcp connections on port 80 to 4 times in two seconds.
iptables -A INPUT [any custom places you want checked] -j burst_check
(for me, I did this:)
iptables -A INPUT -d my.internal.lan.ip -p tcp --dport 80 -j burst_check
iptables -N burst_check
iptables -A burst_check -m state –-state NEW -m recent –-set
iptables -A burst_check -m state –-state NEW -m recent -–update –-seconds 2 -–hitcount 4 -j LOG --log-prefix "hitcount "
iptables -A burst_check -m state –-state NEW -m recent -–update –-seconds 2 -–hitcount 4 -j DROP
Another tool that I found useful was mod_evasive.
The winning combination was I originally wrote a script that was able to identify the bots from the access_log that looped indefinitely adding it to be blocked on iptables. My apache module does the same thing except handles it as the connection comes in and blocks it in iptables before they even get a chance to reconnect. Plus having the flood check in place allowed them to connect only a few times a second until so my script (originally) would have a second to ban them.
As far as blacklists go:
http://www.spamhaus.org/drop/drop.lasso http://www.cymru.com/Documents/bogon-bn-agg.txt APF can add these automated, but I don't use them.
Instead, I'm currently using a list of the 30,000 IP's that hit me over the weekend, plus all of the subnets in thailand. (a large percentage of these bots were in thailand, and they really have no business on my server as-is.)