There are about 12 sites on my server and they are all under attack. Somewhere, there is a backdoor in one of the WordPress plugins. But there are literally hundreds of them, so I have been checking files and code for days in a row now.
Until I find the culprit, scripts are injecting code, creating Japanese search engine SPAM. The worst part about this is that Google is blacklisting some of my sites. This is the third large attack I experience since 1996, so I guess I should not complain. Shit happens.