Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a specific file.
Since the compromising file is gone all requests are met with Apache's minimalistic 404 page, weighing in at about 521bytes. Problem is 512bytes * 1M+ requests is not only taking a toll on our servers performance but is wasting gigs of bandwidth a day.
- The attacks from from hundreds of IP so blocking individual IPs isn't feasible.
- All the requests are POST requests to the same file, lets call it "evil.php".
We tried briefly using a RewriteRule and forbidding all requests to evil.php but this showed a forbidden page leaving us where we started.
Ideally we want just drop the requests to "evil.php" and return nothing. Essentially stop Apache from responding. Is this possible and how?
Let assume for the sake of this exercise there is no shell access and all solutions must be implementable via a cPanel like interface. Although this isn't the case here, our freedom to make configuration changes to the server is small beyond LAMP stack, DNS (bind), and Mail configurations.