I do free/low-cost web/shell hosting as a [non-profit organization](https://www.virtual-info.info/ "Virtual-Info") (With a the same friend and co-founder) since 2007.

We're on CentOS 6 + CPanel, and unfortunately we're still funding the organization from our own money. Since last year, we've noticed some strange subdomains, additional domains and parking domains created for phishing websites, we usually suspend or terminate them until we've noticed it was random and sometimes on trustworthy customers account or even ours (personal admin accounts).

2 months ago, we've rent a new and stronger server, reconfigured it from scratch and migrated the CPanel account, changed passwords, prevented root login without password ans changed our WHM access key, but the "strange" domains/subdomains are still appearing and BuyCpanel (our CPanel licence reseller) told us it seems to be a compromised server and we should investigate it.

We would like to investigate it ourselves but we don't know where to start or how to trace the origin of "compromise", we've checked root connections, FTP connections, WHM connections, we can't find a trace of a script creating the subdomains. Can you give us some advices?

Thanks