I installed fail2ban, but it looks like I need to make my own filters for 444 responses (when something makes a request with an unknown virtual hostname) and requests for *.php.