Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a specific file.

Since the compromising file is gone all requests are met with Apache's minimalistic 404 page, weighing in at about 521bytes. Problem is 512bytes \* 1M+ requests is not only taking a toll on our servers performance but is wasting gigs of bandwidth a day.

* The attacks from from hundreds of IP so blocking individual IPs isn't feasible.
* All the requests are POST requests to the same file, lets call it "evil.php".

We tried briefly using a RewriteRule and forbidding all requests to evil.php but this showed a forbidden page leaving us where we started.

Ideally we want just drop the requests to "evil.php" and return nothing. Essentially stop Apache from responding. Is this possible and how?

**Edit**

Let assume for the sake of this exercise there is no shell access and all solutions must be implementable via a cPanel like interface. Although this isn't the case here, our freedom to make configuration changes to the server is small beyond LAMP stack, DNS (bind), and Mail configurations.