To be honest, this is bullshit, won't mitigate a ddos attack, here's why:

Basically, in a ddos attack, you have the attacker, who has a whole range of 'bots' in his 'botnet'. Basically these bots are everyday computers, heck your computer could be a bot in a botnet if you aren't too careful with security. Then what happens, is the attacker commands his 'bots' to target a site, and to continually make requests to it, hence flooding it and either taking it out or slowing it down because of the amount of traffic it's recieving.

So, the attack comes from just about any PC, anywhere in the world. You can't mitigate it via .htaccess, unless you go and deny every IP address in the world.