The majority of interactions with ddospot appear to be part of DNS amplification attacks. This causes the attack victim's IP address to appear as an IoC in GreedyBear. Also see aelth/ddospot#7