I noticed that a folder with the name of a website I removed keeps appearing under /var/www. I checked and it is created by www-data. I suspect that it's something malicious.
How can I find out what causes this?
SnapOverflow
There's nothing that Apache itself would do to create a folder within /var/www. You might have some other software doing it--maybe a configuration panel.
You're right to be suspicious, but you should spend just a little time ruling out something else legit. Apache's not it, though.
Obviously you want the exact process name that causes it. I would suggest something like auditd to monitor the directory in question, and pinpoint the culprit. You can find a lot of tutorials on the web regarding how to set it up and use, so I will not repost it here. If you run into troubles, or do find what causes it, post a comment.