My first idea is "Wordpress".
Jokes aside, in my experience, 99% of the time it’s compromised WordPress installations rather than the server itself. What I would do is check for any “unexpected” files or plugins that shouldn’t be there, such as:
- WordPresscore
- Filemanager
Additionally, make sure to check for any new users with administrator permissions.
If you’re using Cloudflare, you could enable selective geographic blocking with managed verification to add an extra layer of protection.
Unfortunately, there’s no definitive guide for these situations, as each case is unique.
Do you have any security software installed, such as CPFence?
Having it in place could make things significantly easier for you.
