Today, my data center suspended my VPS for DDoS attack reasons. They say one of my clients, that has WordPress website, started a DDOS attack to another websites using xmlrpc. But I don't know which of my customers abused!
Please tell me how I can find which of my clients started the DDoS attack, because I must terminate then from my VPS.
Also please tell me how I can prevention from same issue if it happens again.
My VPS have CPanel and WHM and SSH access, OS is Centos.