How can I block a specific type of DDoS attack?

Use fail2ban. You can define the pattern and it will make iptables rules according that.

You may be served by putting in a limit to prevent post from the root. Especially if it is "never required by a normal user."

In an .htconfig in your root directory:

<LimitExcept GET>
 Require valid-user
</LimitExcept>

Which will tell it to require a logged-in user for any method but a simple GET (more details). Or if you just want to ban POST at the top:

<Limit POST>
  Deny from all
</Limit>

This will throw a 403-forbidden message, which should tell the scanners to not bother.

To remove the limit, in a directory where you actually want to allow POST:

<Limit POST>
  Allow from all
</Limit>