I got a hack-attack and all my Wordpress instances got modified. Now it seems that I have fixed everything and all my "backdoor-shells" and Wordpress-instances are back running secure (hopefully).
Another problem is that the hacker created several files and blogs (subdirectories) and submitted the sitemap to google and other searchengines.
I have also fixed the sitemaps but now I'm getting lots of requests from spambots which are requesting all domains on the server (about 100) with different requests.
At least all requests looks almost the same (server-status from Apache)
GET /sleep-19899-178.html HTTP/1.1 GET /comments/feed/sport-3736-107.html HTTP/1.1 GET /comments/feed/sport-2416-155.html HTTP/1.1 GET /comments/feed/sport-1962-134.html HTTP/1.1 GET /?attachment_id=30 HTTP/1.0 <-- this is called very often with exploits GET /?attachment_id=30&bla=../../../wp-config.php ... and so on HTTP/1.0
And of course TONS of wp-signup and wp-login requests (Wordpress).
All my Websites sending a 404 which is usually even for spambots a sign that they should stop requesting this page, but they are still doing it.
Is there any way preventing those bots to send requests? Is there a way adding them to fail2ban or dropping by iptables as soon as they requesting a url with the syntax above?