title: Apache/Linux Webserver dynamically block incoming POST requests
body: <p><strong>Backstory</strong>: Recently someone somehow compromised a Xenforo installation linked to my server and injected a endlessly looping php mail() script. It sent thousands of emails from within the domain to the outside world, ending up getting my domain blacklisted from all of the major email ISP's before I had even noticed it was happening. I found the file, which was somehow injected into a cache and skin_cache directory of the forum, and removed them and set up a permanent redirect (using a php header redirect) to an anti-spam harvesting site.</p>
  
  <p><strong>Current problem</strong>: I now am seeing a steady and never-ending flow of POST requests to aforementioned spam scripts. The IP's are different every time, and seem to never stop coming. This has been happening for over a two weeks. So much so that my apache is maxing out its MaxClients setting and running into memory problems, and starting to shut down other processes to compensate.</p>
  
  <p><strong>This is what's showing up in the log</strong>:</p>
  
  <pre><code>190.40.7.126 - - [28/Mar/2013:18:58:30 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  190.104.19.189 - - [28/Mar/2013:18:58:39 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  78.251.159.173 - - [28/Mar/2013:18:58:57 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  219.78.213.10 - - [28/Mar/2013:18:59:09 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  69.123.20.137 - - [28/Mar/2013:18:59:09 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  2.234.181.7 - - [28/Mar/2013:18:59:37 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  187.207.223.67 - - [28/Mar/2013:18:59:44 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  24.242.122.42 - - [28/Mar/2013:19:01:56 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  213.49.254.102 - - [28/Mar/2013:19:02:32 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  82.247.48.152 - - [28/Mar/2013:19:02:38 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  41.135.146.136 - - [28/Mar/2013:19:02:43 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  91.187.93.36 - - [28/Mar/2013:19:03:04 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  194.90.37.132 - - [28/Mar/2013:19:03:40 -0500] "POST /forum/cache/sslFDoB.php HTTP/1.1" 200 3889 "-" "Mozilla/5.0"
  </code></pre>
  
  <p>I need suggestions on the best way to go about handling this problem. Simply redirecting or 404'ing them isn't going to stop the resource usage on the server. There are also so many different IP's at such a constant rate that it's hard to see if there are any duplicate IP's at all. They are all seeming to be on random ranges and of different origins. I'm honestly not sure if these are fake requests, or genuinely compromised clients victim to a spamming xss or virus of some sort. </p>
  
  <p>Would it be reasonable to come up with a way to ban any IP that requests that file dynamically so they can't retry? I need suggestions and help with this please.</p>