I am not sure if i can help, it mostly happened if you have any open SSH user….You need to block his IP
You can use these command on SSH to find the IP’s which sending most request:
netstat -nut | grep :80 | awk ‘{print $4}’ | cut -d: -f1 | sort -n | uniq -cIf
it is found that an IP has more than, say 30 connections, the IP may be causing the attack.
try changing the passwords