This question already has an answer here:
- How do I deal with a compromised server? 12 answers
Today someone phoned me that he was receiving port scans and lots of requests from the IPs of my server.
I indeed see a high memory usage of HTTPD requests in the logs. However, how can I trace this back to an infected website?
I used the Apache domain logs but can't find anything unusual.