I found out that there are too many suspicious requests to the least used feature of my server. To the map preview. Instead of usual 30-40 requests per day usage skyrocketed to 7-10k requests daily, which makes about 10% of all requests. Malefactor have chosen seemingly the most heavy request: indeed, it takes up to ten seconds to load this page in web browser, my server should be already burnt to ashes. Well, no. The fun thing is that this request is the most lightweight, as it returns a static webpage with a couple of scripts, and then all heavy lifting happens on the client side.
Good luck, man.