Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
My hosting provider is telling me that they are misusing my server, I want to know which of my 40 wordpress sites is doing bruteforce to other wordpress sites external to my server.
I scanned with clamav but found nothing.
How can I mitigate the attack?
Use debian 9, vestacp panel, nginx, php-fpm
Look for outgoing connections:
netstat -nputw
Maybe grep for .php
netstat -nputw | grep .php
Also look in your uploads folder for a php file:
find /path/to/uploads | grep .php
