My hosting provider is telling me that they are misusing my server, I want to know which of my 40 wordpress sites is doing bruteforce to other wordpress sites external to my server.

I scanned with clamav but found nothing.

How can I mitigate the attack?

Use debian 9, vestacp panel, nginx, php-fpm

1 Answer 1


Look for outgoing connections:

netstat -nputw

Maybe grep for .php

netstat -nputw | grep .php

Also look in your uploads folder for a php file:

find /path/to/uploads | grep .php

Not the answer you're looking for? Browse other questions tagged or ask your own question.