INCIDENT 2026-08-21 23:29:10 trigger: php_rss=1596MB ================================================================== load: 1.32 1.15 0.97 11/631 1232669 ncpu:10 mem_avail: 5706MB/11729MB (48.6%) swap_used:3564MB swapout:1/s blocked(D):0 running:11 iowait:0.0% steal:0.0% php: 9 procs / 1596MB heaviest user: corpkicks (7 procs, 1364MB) apache: 20 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2523 corpkicks 7 1462 root 238 703 nobody 19 318 netdata 8 250 alison 1 134 madalice 1 114 cpanellogin 1 106 mailman 20 93 evolution 8 28 dovenull 6 26 kurri 2 23 mailnull 3 20 wp-toolkit 6 17 zabbix 1 15 kamcool 1 11 named 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 7 1481 alison 1 136 madalice 1 116 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4947 MB Active(file): 2838 MB Inactive(file): 2064 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 419 MB CommitLimit: 9960 MB Committed_AS: 8199 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 267385 root 22:17:53 2644 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2583656 11.4 Ssl 6-15:38:34 /usr/sbin/mariadbd 1232630 1230637 corpkicks 253512 122 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1232631 1230822 corpkicks 242868 120 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1232636 1232621 corpkicks 242356 118 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1232632 1232628 corpkicks 231540 123 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1232637 1224769 corpkicks 227720 120 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1232635 1232244 corpkicks 225384 122 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 194172 2.5 Ssl 53-13:19:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1232638 1232289 corpkicks 183688 93.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 319521 311538 root 179956 0.0 S 20:51:25 spamd child 1232634 1229937 alison 147752 126 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1232639 1230827 madalice 131072 99.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1210808 1353308 cpanellogin 108984 0.0 S 38:48 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 311538 1 root 88624 0.0 Ss 21:06:24 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 853881 311538 root 88212 0.0 S 09:38:20 spamd child 2575382 1 root 60668 0.0 Ss 6-15:38:37 /usr/lib/systemd/systemd-journald 1353308 1 root 42224 0.0 Ss 30-20:47:46 cpsrvd (SSL) - waiting for connections 2223 1201 root 41744 0.0 Sl 53-13:19:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 38068 0.1 Sl 53-13:19:11 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 25688 0.1 Ss 53-13:19:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1224769 1276780 nobody 23132 0.0 S 13:48 /usr/sbin/httpd -k start 1222842 1276780 nobody 22392 0.0 S 16:44 /usr/sbin/httpd -k start 1229635 1276780 nobody 22316 0.0 S 05:59 /usr/sbin/httpd -k start 1230637 1276780 nobody 21692 0.0 S 04:03 /usr/sbin/httpd -k start 1230822 1276780 nobody 21100 0.0 S 03:40 /usr/sbin/httpd -k start 310731 1 root 20848 0.0 Ss 21:06:56 lfd - sleeping 1229928 1276780 nobody 20460 0.0 S 05:13 /usr/sbin/httpd -k start 1227937 1276780 nobody 20284 0.0 S 08:54 /usr/sbin/httpd -k start 1229914 1276780 nobody 19748 0.2 S 05:15 /usr/sbin/httpd -k start 1229937 1276780 nobody 19456 0.0 S 05:12 /usr/sbin/httpd -k start 1232238 1276780 nobody 19200 0.0 S 00:54 /usr/sbin/httpd -k start 1463 1 root 18208 0.0 Ss 53-13:19:15 tailwatchd 1230827 1276780 nobody 17944 0.0 S 03:39 /usr/sbin/httpd -k start 185104 2431 netdata 17844 2.1 Rl 9-02:55:34 /usr/libexec/netdata/plugins.d/apps.plugin 1 1232244 1276780 nobody 17360 0.0 S 00:53 /usr/sbin/httpd -k start 1232289 1276780 nobody 17052 0.0 S 00:50 /usr/sbin/httpd -k start 1232621 1276780 nobody 16592 0.0 S 00:04 /usr/sbin/httpd -k start 1204 1 zabbix 15984 0.2 Ssl 53-13:19:16 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1232627 1276780 nobody 15980 0.0 S 00:03 /usr/sbin/httpd -k start 1232628 1276780 nobody 15100 0.0 S 00:03 /usr/sbin/httpd -k start 1194867 3828812 kurri 12912 0.0 S 01:06:19 dovecot/imap 405204 1471 root 11740 0.0 S 18:17:59 cPhulkd - dbprocessor 1232640 1276780 nobody 11452 0.0 S 00:01 /usr/sbin/httpd -k start 1276780 1 root 11440 0.0 Ss 16-07:57:51 /usr/sbin/httpd -k start 1230871 3828812 kamcool 11388 0.0 S 03:31 dovecot/pop3 3668761 3828812 kurri 10828 0.0 S 1-13:14:55 dovecot/imap 1232409 1471 root 10748 0.0 S 00:34 cPhulkd - processor - http socket 1471 1 root 10660 0.0 Ss 53-13:19:15 cPhulkd - processor 2107664 1 named 10572 0.0 Ssl 2-21:06:30 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2107879 1 root 9260 0.0 Ss 2-21:06:29 queueprocd - waiting up to 60s to process a task 918817 27524 root 8848 0.0 Ss 08:15:12 sshd: evolution [priv] 1059098 3828812 dovenull 8052 0.0 S 8-07:56:21 dovecot/imap-login 1232629 2111716 mailnull 7764 0.0 S 00:03 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1232560 2111716 mailnull 7564 0.0 S 00:09 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1466 1 root 7476 0.0 Ss 53-13:19:15 dnsadmin - dormant mode 1059102 3828812 dovenull 7392 0.0 S 8-07:56:21 dovecot/imap-login 2111078 1 nscd 7352 0.0 Rsl 2-21:06:19 /usr/sbin/nscd 4028163 27524 root 6592 0.0 Ss 1-08:09:33 sshd: evolution [priv] 4161699 27524 root 6276 0.0 Ss 1-05:41:29 sshd: evolution [priv] 1 0 root 6140 0.2 Ss 53-13:19:24 /usr/lib/systemd/systemd --switched-root --system --deserialize 17 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 22989328 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 59 alison/alisonarts.com.au-ssl_log 39 otter2/otterfencing.net.au-ssl_log 23 evolution/portal.evolutionerp.com.au-ssl_log 16 evolution/staging.evolutionerp.com.au 5 evolution/staging.evolutionerp.com.au-ssl_log 5 corpkicks/2025.corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 50 20.65.105.233 36 172.212.194.58 23 51.116.232.28 16 203.54.180.238 10 91.224.92.159 3 114.119.146.16 2 51.68.111.241 2 161.153.54.80 1 91.92.243.245 1 20.226.7.189 1 121.229.156.35 1 114.119.137.101 1 114.119.131.88 1 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 16 GET /heartbeat.php 6 GET /store/design-your-own-send-in/ 2 GET /wp-includes/wp-class.php 2 GET /wp-includes/pomo/install.php 2 GET /wp-includes/assets/about.php 2 GET /wp-content/upgrade-temp-backup/wp-login.php 2 GET /wp-content/themes/twenty/twenty.php 2 GET /wp-content/themes/cay-van-phong/filemanager.php 2 GET /wp-content/themes/aahana/json.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-content/plugins/admin.php 2 GET /wp-admin/includes/install.php 2 GET /wander.php 2 GET /this_is_a_new_hello_world.php 2 GET /sta.php 2 GET /sql.php 2 GET /shell20211028.php 2 GET /sg.php 2 GET /packed.php 2 GET /ms.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/design-your-own-send-in/ 2 GET /wp-includes/wp-class.php 2 GET /wp-includes/pomo/install.php 2 GET /wp-includes/assets/about.php 2 GET /wp-content/upgrade-temp-backup/wp-login.php 2 GET /wp-content/themes/twenty/twenty.php 2 GET /wp-content/themes/cay-van-phong/filemanager.php 2 GET /wp-content/themes/aahana/json.php 2 GET /wp-content/plugins/admin.php 2 GET /wp-admin/includes/install.php 2 GET /wander.php 2 GET /sta.php -- last 10 requests -- 20.65.105.233 - - [21/Aug/2026:23:28:47 +1000] "GET /wp-content/plugins/admin.php HTTP/1.1" 301 1 "-" "-" 20.65.105.233 - - [21/Aug/2026:23:28:49 +1000] "GET /wp-content/plugins/admin.php HTTP/1.1" 404 30642 "-" "-" 20.65.105.233 - - [21/Aug/2026:23:28:52 +1000] "GET /wp-includes/assets/about.php HTTP/1.1" 301 1 "-" "-" 20.65.105.233 - - [21/Aug/2026:23:28:55 +1000] "GET /wp-includes/assets/about.php HTTP/1.1" 404 30649 "-" "-" 20.65.105.233 - - [21/Aug/2026:23:28:57 +1000] "GET /1.php HTTP/1.1" 301 1 "-" "-" 20.65.105.233 - - [21/Aug/2026:23:29:00 +1000] "GET /1.php HTTP/1.1" 404 30635 "-" "-" 20.65.105.233 - - [21/Aug/2026:23:29:03 +1000] "GET /wp-content/uploads/wp-conflg.php HTTP/1.1" 403 12 "-" "-" 20.65.105.233 - - [21/Aug/2026:23:29:03 +1000] "GET /wander.php HTTP/1.1" 301 1 "-" "-" 114.119.146.16 - - [21/Aug/2026:23:29:03 +1000] "GET /store/design-your-own-send-in/?amp%3Brating=1&wcpr_rating=5&wcpr_verified=1&wcpr_page=4 HTTP/1.1" 200 47933 "https://madalice.com.au/store/design-your-own-send-in/?am 20.65.105.233 - - [21/Aug/2026:23:29:05 +1000] "GET /wander.php HTTP/1.1" 404 30642 "-" "-" == alison/alisonarts.com.au-ssl_log == -- top paths -- 1 GET /Zoo.php 1 GET /zoko.php 1 GET /xwx1.php 1 GET /xrp.php 1 GET /xr.php 1 GET /xp.php 1 GET /xmlrpc.php 1 GET /xingkong/index.php 1 GET /xex.php 1 GET /xd.php 1 GET /wyzer1.php 1 GET /wtiiy.php -- last 10 requests -- 172.212.194.58 - - [21/Aug/2026:23:28:16 +1000] "GET /xmlrpc.php HTTP/1.1" 401 36 "-" "-" 172.212.194.58 - - [21/Aug/2026:23:28:17 +1000] "GET /wp-god.Php HTTP/1.1" 401 36 "-" "-" 172.212.194.58 - - [21/Aug/2026:23:28:17 +1000] "GET /wp-admin/zoko.php HTTP/1.1" 401 36 "-" "-" 172.212.194.58 - - [21/Aug/2026:23:28:18 +1000] "GET /wpxml.php HTTP/1.1" 401 36 "-" "-" 172.212.194.58 - - [21/Aug/2026:23:28:18 +1000] "GET /zoko.php HTTP/1.1" 401 36 "-" "-" 172.212.194.58 - - [21/Aug/2026:23:28:19 +1000] "GET /wp-content/options.php HTTP/1.1" 401 36 "-" "-" 172.212.194.58 - - [21/Aug/2026:23:28:19 +1000] "GET /xrp.php HTTP/1.1" 401 36 "-" "-" 172.212.194.58 - - [21/Aug/2026:23:28:19 +1000] "GET /wp-content/radio.php HTTP/1.1" 401 36 "-" "-" 172.212.194.58 - - [21/Aug/2026:23:28:20 +1000] "GET /Zoo.php HTTP/1.1" 401 36 "-" "-" 172.212.194.58 - - [21/Aug/2026:23:28:20 +1000] "GET /wp-sing.php HTTP/1.1" 401 36 "-" "-" == otter2/otterfencing.net.au-ssl_log == -- top paths -- 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /sf.php 1 GET /reinacti.php 1 GET /pyrethrumize.php 1 GET /pk.php 1 GET /ops.php 1 GET /k.php 1 GET /inso.php 1 GET /images.php 1 GET /filemanager.php 1 GET /dex.php -- last 10 requests -- 51.116.232.28 - - [21/Aug/2026:23:27:09 +1000] "GET /images.php HTTP/1.1" 404 5750 "-" "-" 51.116.232.28 - - [21/Aug/2026:23:27:10 +1000] "GET /ops.php HTTP/1.1" 404 5750 "-" "-" 51.116.232.28 - - [21/Aug/2026:23:27:11 +1000] "GET /coffexium.php HTTP/1.1" 404 5750 "-" "-" 51.116.232.28 - - [21/Aug/2026:23:27:11 +1000] "GET /BDKR28WP.php HTTP/1.1" 404 5750 "-" "-" 51.116.232.28 - - [21/Aug/2026:23:27:12 +1000] "GET /sf.php HTTP/1.1" 404 5750 "-" "-" 51.116.232.28 - - [21/Aug/2026:23:27:12 +1000] "GET /k.php?p= HTTP/1.1" 404 5750 "-" "-" 51.116.232.28 - - [21/Aug/2026:23:27:13 +1000] "GET /82.php HTTP/1.1" 404 5750 "-" "-" 51.116.232.28 - - [21/Aug/2026:23:27:13 +1000] "GET /dex.php HTTP/1.1" 404 5750 "-" "-" 51.116.232.28 - - [21/Aug/2026:23:27:14 +1000] "GET /inso.php HTTP/1.1" 404 5750 "-" "-" 51.116.232.28 - - [21/Aug/2026:23:27:14 +1000] "GET /aa.php HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-21 23:26:40 L1=1.26 run=2 blk=0 avail=6811 (58.1%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=226 ap=17 tcp=20 topuser=madalice 2026-08-21 23:26:49 L1=1.21 run=4 blk=0 avail=6961 (59.3%) swpO=0 conn=3 myRSS=2522 php=1 phpRSS=88 ap=17 tcp=21 topuser=madalice 2026-08-21 23:26:50 L1=1.21 run=3 blk=0 avail=6886 (58.7%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=159 ap=17 tcp=18 topuser=madalice 2026-08-21 23:26:59 L1=1.25 run=1 blk=1 avail=7019 (59.8%) swpO=1 conn=3 myRSS=2522 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-21 23:27:00 L1=1.25 run=2 blk=0 avail=6939 (59.2%) swpO=1 conn=2 myRSS=2522 php=1 phpRSS=109 ap=17 tcp=21 topuser=madalice 2026-08-21 23:27:09 L1=1.22 run=2 blk=0 avail=6798 (58.0%) swpO=0 conn=3 myRSS=2522 php=1 phpRSS=257 ap=17 tcp=24 topuser=madalice 2026-08-21 23:27:10 L1=1.22 run=2 blk=0 avail=6992 (59.6%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=59 ap=17 tcp=23 topuser=madalice 2026-08-21 23:27:19 L1=1.33 run=3 blk=0 avail=6861 (58.5%) swpO=0 conn=3 myRSS=2522 php=2 phpRSS=205 ap=18 tcp=28 topuser=madalice 2026-08-21 23:27:20 L1=1.33 run=7 blk=0 avail=6718 (57.3%) swpO=0 conn=2 myRSS=2522 php=2 phpRSS=349 ap=18 tcp=24 topuser=madalice 2026-08-21 23:27:29 L1=1.28 run=2 blk=0 avail=6954 (59.3%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=82 ap=18 tcp=24 topuser=madalice 2026-08-21 23:27:30 L1=1.28 run=2 blk=0 avail=6877 (58.6%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=157 ap=18 tcp=24 topuser=madalice 2026-08-21 23:27:39 L1=1.39 run=2 blk=1 avail=6854 (58.4%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=179 ap=18 tcp=23 topuser=madalice 2026-08-21 23:27:40 L1=1.39 run=2 blk=0 avail=7000 (59.7%) swpO=0 conn=2 myRSS=2522 php=0 phpRSS=0 ap=18 tcp=22 topuser=- 2026-08-21 23:27:49 L1=1.33 run=2 blk=0 avail=6914 (58.9%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=127 ap=18 tcp=20 topuser=madalice 2026-08-21 23:27:50 L1=1.33 run=2 blk=0 avail=6836 (58.3%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=204 ap=18 tcp=19 topuser=madalice 2026-08-21 23:27:59 L1=1.20 run=1 blk=0 avail=7012 (59.8%) swpO=0 conn=2 myRSS=2522 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-21 23:28:00 L1=1.20 run=3 blk=0 avail=6932 (59.1%) swpO=0 conn=2 myRSS=2522 php=2 phpRSS=142 ap=17 tcp=23 topuser=madalice 2026-08-21 23:28:09 L1=1.17 run=2 blk=0 avail=6777 (57.8%) swpO=2 conn=2 myRSS=2522 php=1 phpRSS=261 ap=17 tcp=23 topuser=madalice 2026-08-21 23:28:10 L1=1.17 run=2 blk=0 avail=6958 (59.3%) swpO=2 conn=3 myRSS=2522 php=2 phpRSS=107 ap=17 tcp=22 topuser=madalice 2026-08-21 23:28:19 L1=1.15 run=4 blk=0 avail=6749 (57.5%) swpO=0 conn=2 myRSS=2522 php=2 phpRSS=301 ap=21 tcp=28 topuser=madalice 2026-08-21 23:28:20 L1=1.15 run=2 blk=0 avail=6810 (58.1%) swpO=0 conn=3 myRSS=2522 php=2 phpRSS=230 ap=23 tcp=28 topuser=madalice 2026-08-21 23:28:29 L1=1.12 run=3 blk=0 avail=6875 (58.6%) swpO=0 conn=2 myRSS=2522 php=2 phpRSS=166 ap=21 tcp=26 topuser=madalice 2026-08-21 23:28:30 L1=1.12 run=3 blk=0 avail=6695 (57.1%) swpO=0 conn=3 myRSS=2522 php=3 phpRSS=384 ap=21 tcp=25 topuser=madalice 2026-08-21 23:28:39 L1=1.17 run=2 blk=0 avail=6920 (59.0%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=97 ap=21 tcp=25 topuser=madalice 2026-08-21 23:28:40 L1=1.17 run=3 blk=0 avail=6788 (57.9%) swpO=0 conn=3 myRSS=2522 php=3 phpRSS=289 ap=21 tcp=26 topuser=madalice 2026-08-21 23:28:49 L1=1.22 run=2 blk=0 avail=6957 (59.3%) swpO=0 conn=2 myRSS=2522 php=1 phpRSS=59 ap=21 tcp=20 topuser=madalice 2026-08-21 23:28:50 L1=1.22 run=2 blk=0 avail=6883 (58.7%) swpO=0 conn=3 myRSS=2522 php=2 phpRSS=170 ap=21 tcp=22 topuser=madalice 2026-08-21 23:28:59 L1=1.18 run=3 blk=0 avail=6997 (59.7%) swpO=0 conn=2 myRSS=2523 php=0 phpRSS=0 ap=19 tcp=20 topuser=- 2026-08-21 23:29:00 L1=1.18 run=2 blk=0 avail=6938 (59.2%) swpO=0 conn=3 myRSS=2523 php=2 phpRSS=137 ap=18 tcp=22 topuser=madalice 2026-08-21 23:29:10 L1=1.32 run=11 blk=0 avail=5706 (48.6%) swpO=1 conn=10 myRSS=2523 php=9 phpRSS=1596 ap=20 tcp=32 topuser=corpkicks