Hi PGT92.
In fact, in both, we found the phantom domain "superkkt.com" on old server, but we reinstalled whole server and imported with PMM only the selected domains.
Maybe some websites where already infected with some sort of troyan?
We're already inspecting al files on servers