INCIDENT 2026-08-27 18:58:03 trigger: php_rss=2150MB mysql_conn=21 ================================================================== load: 2.42 1.79 1.44 24/724 3150207 ncpu:10 mem_avail: 6790MB/13777MB (49.3%) swap_used:2407MB swapout:0/s blocked(D):0 running:23 iowait:1.0% steal:0.0% php: 21 procs / 2150MB heaviest user: corpkicks (20 procs, 2108MB) apache: 72 procs tcp_estab: 44 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2779 corpkicks 22 2323 nobody 72 1468 root 239 780 netdata 8 258 infinium 2 82 cpanellogin 1 71 mailman 20 47 dovenull 6 44 alison 2 29 wp-toolkit 6 18 dovecot 3 17 zabbix 1 13 kurri 1 7 nscd 1 5 named 1 4 cpanelconnecttrack 1 3 mailnull 1 2 evolution 4 2 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB corpkicks 23 2434 root 1 42 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5648 MB Active(file): 4313 MB Inactive(file): 1602 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 491 MB CommitLimit: 10984 MB Committed_AS: 10004 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3565593 root 17:46:47 2908 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2845696 16.6 Ssl 2-15:26:47 /usr/sbin/mariadbd 3150131 3149715 corpkicks 207664 101 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 204728 2.5 Ssl 59-08:48:13 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3150139 3149652 corpkicks 203600 98.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150132 3149654 corpkicks 184628 82.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150134 3149686 corpkicks 183636 83.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150136 3149657 corpkicks 180536 80.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150133 3149645 corpkicks 176392 81.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1910875 3797563 root 168108 0.1 S 05:44:11 spamd child 3150135 3149350 corpkicks 160636 72.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150137 3149642 corpkicks 158400 70.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150138 3149681 corpkicks 148140 65.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150163 3149694 corpkicks 142816 60.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150164 3149714 corpkicks 129692 51.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3846467 3797563 root 126316 0.0 S 16:22:29 spamd child 3150174 3149667 corpkicks 108032 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150166 3149722 corpkicks 100024 36.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150167 3149690 corpkicks 96748 33.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150173 3149725 corpkicks 96516 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150168 3149674 corpkicks 91192 32.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150170 3149707 corpkicks 90680 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150171 3149665 corpkicks 87840 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150169 3149669 corpkicks 83904 29.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150175 3149666 corpkicks 82656 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3797563 1 root 78736 0.0 Ss 16:35:07 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2805458 1353308 cpanellogin 73172 0.0 S 01:38:35 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3150204 3149679 corpkicks 66112 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2575382 1 root 63520 0.0 Ss 12-11:07:34 /usr/lib/systemd/systemd-journald 3150203 3149693 corpkicks 62040 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3150196 3149673 corpkicks 57888 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3118122 1353308 infinium 55356 0.0 S 08:14 webmaild - serving 1.41.252.211 2223 1201 root 43340 0.0 Sl 59-08:48:12 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3066250 1 root 43124 0.0 Ss 26:38 php-fpm: master process (/opt/cpanel/ea-php82/root/etc/php-fpm.conf) 1353308 1 root 41736 0.0 Ss 36-16:16:43 cpsrvd (SSL) - waiting for connections 3150230 3149675 corpkicks 37880 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 4922 2431 netdata 33288 0.1 Sl 59-08:48:08 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3118124 2938073 infinium 29208 0.0 S 08:14 php-fpm: pool user_infinium 3125006 3066150 nobody 24488 0.0 S 07:57 /usr/sbin/httpd -k start 3118178 3066150 nobody 23976 0.0 S 08:11 /usr/sbin/httpd -k start 3148833 3066150 nobody 23728 0.0 S 02:28 /usr/sbin/httpd -k start 3149698 3066150 nobody 23140 0.0 S 00:43 /usr/sbin/httpd -k start 3149675 3066150 nobody 22476 0.0 S 00:44 /usr/sbin/httpd -k start 3149666 3066150 nobody 22052 0.0 S 00:44 /usr/sbin/httpd -k start 3149707 3066150 nobody 21956 0.0 S 00:43 /usr/sbin/httpd -k start 3149665 3066150 nobody 21940 0.0 S 00:44 /usr/sbin/httpd -k start 3149682 3066150 nobody 21920 0.0 S 00:43 /usr/sbin/httpd -k start 3149664 3066150 nobody 21912 0.0 S 00:44 /usr/sbin/httpd -k start 3149694 3066150 nobody 21888 0.0 S 00:43 /usr/sbin/httpd -k start 3149667 3066150 nobody 21864 0.0 S 00:44 /usr/sbin/httpd -k start 3149654 3066150 nobody 21844 0.0 S 00:45 /usr/sbin/httpd -k start 3149660 3066150 nobody 21796 0.0 S 00:44 /usr/sbin/httpd -k start 3149673 3066150 nobody 21792 0.0 S 00:44 /usr/sbin/httpd -k start 3149668 3066150 nobody 21768 0.0 S 00:44 /usr/sbin/httpd -k start 3149662 3066150 nobody 21716 0.0 S 00:44 /usr/sbin/httpd -k start 3149669 3066150 nobody 21692 0.0 S 00:44 /usr/sbin/httpd -k start 3149679 3066150 nobody 21692 0.0 S 00:43 /usr/sbin/httpd -k start 3149652 3066150 nobody 21668 0.0 S 00:45 /usr/sbin/httpd -k start 3149699 3066150 nobody 21668 0.0 S 00:43 /usr/sbin/httpd -k start 3149347 3066150 nobody 21652 0.1 R 01:15 /usr/sbin/httpd -k start 3149710 3066150 nobody 21624 0.0 S 00:43 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 13908381 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/auction.madalice.com.au-ssl_log 90 tubesupplies/tubesupplies.com.au-ssl_log 49 cosgrovecreative/cosgrovecreative.com.au 47 evolution/my.evolutionerp.com.au-ssl_log 38 corpkicks/corporatekicks.com.au-ssl_log 22 evolution/portal.evolutionerp.com.au-ssl_log 20 aaa/aaadownunder.com.au-ssl_log 6 madalice/madalice.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 90 20.151.129.194 47 20.220.227.7 45 172.191.149.99 35 175.36.227.212 20 203.54.180.238 5 118.127.40.55 2 40.77.167.1 2 209.141.57.84 2 162.241.216.122 2 149.19.253.189 1 98.93.236.103 1 95.215.38.188 1 94.176.88.49 1 93.115.5.111 1 89.34.79.174 --- top request paths across all vhosts (last 3 min) --- 45 GET /autodiscover/autodiscover.xml 20 GET /heartbeat.php 13 GET /app/ajax.php 6 GET /index.php 5 POST /wp-cron.php 4 POST /functions.php 4 POST /app/ajax.php 3 POST /plugins/csvexporter/plugin.php 3 GET /wp-login.php 2 POST /wp-login.php 2 POST /opportunityeditsave.php 2 POST /app/ajax/selectFilterSingle.php 2 POST /app/ajax/selectFilter.php 2 HEAD / 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /red.php 2 GET /mac.php 2 GET /file52.php 2 GET /custom-shoe-services/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/auction.madalice.com.au-ssl_log == -- top paths -- 1 GET /yj09.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-0.php 1 GET /verox.php 1 GET /this_is_a_new_hello_world.php 1 GET /system_log.php 1 GET /sky.php 1 GET /sixxis.php -- last 10 requests -- 20.151.129.194 - - [27/Aug/2026:18:56:26 +1000] "GET /inso.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [27/Aug/2026:18:56:26 +1000] "GET /shiny.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [27/Aug/2026:18:56:26 +1000] "GET /403dd.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [27/Aug/2026:18:56:26 +1000] "GET /baba.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [27/Aug/2026:18:56:26 +1000] "GET /site.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [27/Aug/2026:18:56:27 +1000] "GET /cabs.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [27/Aug/2026:18:56:27 +1000] "GET /insc.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [27/Aug/2026:18:56:27 +1000] "GET /file.php? HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [27/Aug/2026:18:56:27 +1000] "GET /dex.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [27/Aug/2026:18:56:28 +1000] "GET /key.php HTTP/1.1" 404 - "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 45 GET /autodiscover/autodiscover.xml 2 GET /wp-login.php 1 POST /wp-login.php 1 POST /wp-cron.php -- last 10 requests -- 172.191.149.99 - - [27/Aug/2026:18:57:29 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 172.191.149.99 - - [27/Aug/2026:18:57:30 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 172.191.149.99 - - [27/Aug/2026:18:57:30 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 172.191.149.99 - - [27/Aug/2026:18:57:31 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 172.191.149.99 - - [27/Aug/2026:18:57:32 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 172.191.149.99 - - [27/Aug/2026:18:57:33 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 172.191.149.99 - - [27/Aug/2026:18:57:34 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.87.233.198 - - [27/Aug/2026:18:57:32 +1000] "GET /wp-login.php HTTP/1.1" 200 2100 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 118.127.40.55 - - [27/Aug/2026:18:57:34 +1000] "POST /wp-cron.php?doing_wp_cron=1787821054.1157100200653076171875 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://tubesupplies.com.au" 172.191.149.99 - - [27/Aug/2026:18:57:35 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" == cosgrovecreative/cosgrovecreative.com.au == -- top paths -- 1 GET /wp-mail.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/admin.php 1 GET /this_is_a_new_hello_world.php 1 GET /style.php 1 GET /socket.php 1 GET /sid4.php 1 GET /secure.php 1 GET /sd.php 1 GET /samll.php 1 GET /red.php 1 GET /pusher.php -- last 10 requests -- 20.220.227.7 - - [27/Aug/2026:18:57:43 +1000] "GET /bless3.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [27/Aug/2026:18:57:43 +1000] "GET /red.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [27/Aug/2026:18:57:43 +1000] "GET /ans.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [27/Aug/2026:18:57:44 +1000] "GET /k2.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [27/Aug/2026:18:57:44 +1000] "GET /inc.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [27/Aug/2026:18:57:44 +1000] "GET /file52.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [27/Aug/2026:18:57:44 +1000] "GET //aa.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [27/Aug/2026:18:57:45 +1000] "GET /sd.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [27/Aug/2026:18:57:45 +1000] "GET /ot.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [27/Aug/2026:18:57:45 +1000] "GET /201.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-27 18:55:42 L1=1.87 run=3 blk=0 avail=8318 (60.4%) swpO=0 conn=3 myRSS=2781 php=3 phpRSS=392 ap=21 tcp=21 topuser=otterfencing 2026-08-27 18:55:43 L1=1.80 run=2 blk=0 avail=8412 (61.1%) swpO=0 conn=3 myRSS=2781 php=2 phpRSS=266 ap=21 tcp=19 topuser=otterfencing 2026-08-27 18:55:52 L1=1.81 run=4 blk=0 avail=8368 (60.7%) swpO=0 conn=3 myRSS=2782 php=4 phpRSS=401 ap=16 tcp=21 topuser=tubesupplies 2026-08-27 18:55:53 L1=1.83 run=6 blk=0 avail=8306 (60.3%) swpO=0 conn=3 myRSS=2782 php=4 phpRSS=457 ap=16 tcp=25 topuser=otterfencing 2026-08-27 18:56:02 L1=1.76 run=2 blk=0 avail=8433 (61.2%) swpO=0 conn=3 myRSS=2782 php=2 phpRSS=265 ap=16 tcp=20 topuser=otterfencing 2026-08-27 18:56:03 L1=1.78 run=2 blk=0 avail=8436 (61.2%) swpO=0 conn=3 myRSS=2782 php=2 phpRSS=263 ap=16 tcp=20 topuser=otterfencing 2026-08-27 18:56:12 L1=1.72 run=2 blk=0 avail=8294 (60.2%) swpO=0 conn=3 myRSS=2782 php=3 phpRSS=441 ap=16 tcp=19 topuser=otterfencing 2026-08-27 18:56:13 L1=1.66 run=4 blk=0 avail=8293 (60.2%) swpO=0 conn=3 myRSS=2782 php=3 phpRSS=441 ap=16 tcp=19 topuser=otterfencing 2026-08-27 18:56:22 L1=1.61 run=3 blk=0 avail=8446 (61.3%) swpO=0 conn=3 myRSS=2782 php=2 phpRSS=266 ap=15 tcp=20 topuser=otterfencing 2026-08-27 18:56:23 L1=1.72 run=3 blk=0 avail=8315 (60.4%) swpO=0 conn=3 myRSS=2782 php=3 phpRSS=429 ap=15 tcp=20 topuser=otterfencing 2026-08-27 18:56:32 L1=1.66 run=2 blk=0 avail=8445 (61.3%) swpO=0 conn=3 myRSS=2784 php=2 phpRSS=266 ap=15 tcp=19 topuser=otterfencing 2026-08-27 18:56:33 L1=1.61 run=3 blk=0 avail=8444 (61.3%) swpO=0 conn=2 myRSS=2784 php=2 phpRSS=266 ap=15 tcp=19 topuser=otterfencing 2026-08-27 18:56:42 L1=1.64 run=2 blk=0 avail=8442 (61.3%) swpO=0 conn=2 myRSS=2784 php=2 phpRSS=265 ap=15 tcp=20 topuser=otterfencing 2026-08-27 18:56:43 L1=1.59 run=3 blk=0 avail=8418 (61.1%) swpO=0 conn=2 myRSS=2784 php=3 phpRSS=319 ap=15 tcp=22 topuser=otterfencing 2026-08-27 18:56:52 L1=1.54 run=3 blk=0 avail=8336 (60.5%) swpO=0 conn=2 myRSS=2788 php=2 phpRSS=263 ap=29 tcp=27 topuser=otterfencing 2026-08-27 18:56:53 L1=1.50 run=3 blk=0 avail=8317 (60.4%) swpO=0 conn=2 myRSS=2788 php=3 phpRSS=320 ap=28 tcp=27 topuser=otterfencing 2026-08-27 18:57:02 L1=1.38 run=2 blk=0 avail=8324 (60.4%) swpO=0 conn=2 myRSS=2788 php=3 phpRSS=363 ap=21 tcp=22 topuser=otterfencing 2026-08-27 18:57:03 L1=1.35 run=4 blk=0 avail=8468 (61.5%) swpO=0 conn=2 myRSS=2788 php=2 phpRSS=192 ap=21 tcp=20 topuser=otterfencing 2026-08-27 18:57:12 L1=1.24 run=2 blk=1 avail=8436 (61.2%) swpO=0 conn=2 myRSS=2788 php=2 phpRSS=240 ap=17 tcp=18 topuser=otterfencing 2026-08-27 18:57:13 L1=1.14 run=2 blk=0 avail=8401 (61.0%) swpO=0 conn=2 myRSS=2788 php=3 phpRSS=300 ap=17 tcp=21 topuser=otterfencing 2026-08-27 18:57:23 L1=2.33 run=3 blk=0 avail=7881 (57.2%) swpO=713 conn=2 myRSS=2779 php=2 phpRSS=81 ap=112 tcp=84 topuser=root 2026-08-27 18:57:23 L1=2.14 run=1 blk=0 avail=7888 (57.3%) swpO=785 conn=2 myRSS=2779 php=1 phpRSS=42 ap=112 tcp=70 topuser=root 2026-08-27 18:57:33 L1=1.97 run=4 blk=0 avail=7919 (57.5%) swpO=0 conn=2 myRSS=2779 php=2 phpRSS=94 ap=103 tcp=20 topuser=tubesupplies 2026-08-27 18:57:33 L1=1.89 run=2 blk=0 avail=7887 (57.2%) swpO=0 conn=2 myRSS=2779 php=2 phpRSS=141 ap=102 tcp=20 topuser=tubesupplies 2026-08-27 18:57:43 L1=1.74 run=1 blk=0 avail=8032 (58.3%) swpO=0 conn=1 myRSS=2779 php=1 phpRSS=42 ap=93 tcp=20 topuser=root 2026-08-27 18:57:43 L1=1.60 run=1 blk=0 avail=8040 (58.4%) swpO=0 conn=2 myRSS=2779 php=1 phpRSS=42 ap=92 tcp=20 topuser=root 2026-08-27 18:57:53 L1=1.47 run=5 blk=0 avail=7912 (57.4%) swpO=0 conn=1 myRSS=2779 php=5 phpRSS=337 ap=83 tcp=29 topuser=aaa 2026-08-27 18:57:53 L1=1.92 run=3 blk=0 avail=8005 (58.1%) swpO=0 conn=2 myRSS=2779 php=3 phpRSS=212 ap=82 tcp=29 topuser=alison 2026-08-27 18:58:03 L1=2.42 run=11 blk=0 avail=8020 (58.2%) swpO=0 conn=1 myRSS=2779 php=10 phpRSS=489 ap=73 tcp=35 topuser=corpkicks 2026-08-27 18:58:03 L1=2.42 run=23 blk=0 avail=6790 (49.3%) swpO=0 conn=21 myRSS=2779 php=21 phpRSS=2150 ap=72 tcp=44 topuser=corpkicks