Do you allow user generated content at all that is internet accessible? Have you looked up your domain and IPS in virustotal and other similar services? Can users host any type of file that can be accessed without authentication?
Yes/no/yes to the above questions means that is where you should look.
Yes/no/yes to the above questions means that is where you should look.