Softlayer just disabled traffic to one of our dedicated boxes "Due to the large amount of traffic targeted to your IP address".

This box is a standard LAMP setup and we're such a small operation I doubt anyone would purposely target us.

How are events like these normally handled (in terms of mitigation, post-mortem, etc.)? Has anyone else dealt with this recently?