INCIDENT 2026-08-28 23:57:27 trigger: mysql_conn=85 ================================================================== load: 23.61 8.92 3.69 1/746 937676 ncpu:10 mem_avail: 8020MB/13777MB (58.2%) swap_used:1336MB swapout:0/s blocked(D):0 running:1 iowait:0.3% steal:0.0% php: 6 procs / 652MB heaviest user: madalice (4 procs, 617MB) apache: 119 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2446 nobody 118 1874 root 248 889 madalice 4 617 mailman 20 244 netdata 7 198 cpanellogin 1 80 wp-toolkit 3 58 dovenull 6 56 infinium 3 42 kurri 3 37 evolution 7 31 lowrange 2 29 zabbix 1 25 dovecot 3 23 named 1 15 vinesit 1 14 corpkicks 1 14 aaa 1 14 mailnull 1 9 --- php workers by user --- USER PROCS RSS_MB madalice 4 617 root 1 19 evolution 1 15 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2999 MB Active(file): 1825 MB Inactive(file): 1330 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 556 MB CommitLimit: 10984 MB Committed_AS: 9031 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 21:38:47 7444 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2504884 13.5 Ssl 21:38:16 /usr/sbin/mariadbd 508924 1 netdata 175596 2.0 Ssl 21:37:45 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 168448 0.0 S 21:33:09 spamd child 936925 510022 madalice 158432 7.6 S 00:39 php-fpm: pool madalice_com_au 935502 510022 madalice 158364 11.0 S 01:22 php-fpm: pool madalice_com_au 936996 510022 madalice 157768 11.5 S 00:36 php-fpm: pool madalice_com_au 937002 510022 madalice 157600 7.6 S 00:36 php-fpm: pool madalice_com_au 527476 1 root 83340 0.0 Ss 21:34:48 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4074469 1353308 cpanellogin 82048 0.0 S 05:08:02 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2985227 527476 root 72716 0.0 S 10:18:46 spamd child 509266 1 root 67436 0.0 Ss 21:37:42 /usr/lib/systemd/systemd-journald 509236 509098 root 59364 0.0 Sl 21:37:42 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 36520 0.1 Ss 37-21:16:08 cpsrvd (SSL) - waiting for connections 938582 1 wp-toolkit 34636 0.0 Ss 19:45:19 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 937649 1469 root 29292 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 28548 0.0 Ss 21:35:11 lfd - sleeping 509640 508992 root 27584 0.0 Sl 21:37:40 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 483898 1 zabbix 26348 0.2 Ssl 21:38:59 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 24428 0.1 Ss 60-13:47:37 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938585 1 wp-toolkit 22536 0.0 Ss 19:45:19 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 21672 0.0 Ss 60-13:47:37 tailwatchd 935491 506832 nobody 19752 0.0 S 01:22 /usr/sbin/httpd -k start 935385 506832 nobody 19732 0.0 S 01:24 /usr/sbin/httpd -k start 510022 1 root 19612 0.0 Ss 21:37:38 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 935492 506832 nobody 19452 0.0 S 01:22 /usr/sbin/httpd -k start 935387 506832 nobody 19300 0.0 S 01:24 /usr/sbin/httpd -k start 935790 506832 nobody 19288 0.0 S 01:08 /usr/sbin/httpd -k start 936078 506832 nobody 19272 0.0 S 01:01 /usr/sbin/httpd -k start 936745 506832 nobody 19220 0.0 S 00:44 /usr/sbin/httpd -k start 935489 506832 nobody 19176 0.0 S 01:22 /usr/sbin/httpd -k start 935408 506832 nobody 19164 0.0 S 01:23 /usr/sbin/httpd -k start 935480 506832 nobody 19156 0.0 S 01:22 /usr/sbin/httpd -k start 936675 506832 nobody 19148 0.0 S 00:47 /usr/sbin/httpd -k start 936501 506832 nobody 19052 0.0 S 00:52 /usr/sbin/httpd -k start 936693 506832 nobody 18996 0.0 S 00:46 /usr/sbin/httpd -k start 936585 506832 nobody 18960 0.0 S 00:50 /usr/sbin/httpd -k start 936333 506832 nobody 18940 0.0 S 00:58 /usr/sbin/httpd -k start 935410 506832 nobody 18916 0.0 S 01:23 /usr/sbin/httpd -k start 936906 506832 nobody 18840 0.0 S 00:39 /usr/sbin/httpd -k start 481558 1 root 18660 0.1 Ssl 21:40:09 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 935409 506832 nobody 18624 0.0 S 01:23 /usr/sbin/httpd -k start 936567 506832 nobody 18396 0.0 S 00:51 /usr/sbin/httpd -k start 935386 506832 nobody 18340 0.0 S 01:24 /usr/sbin/httpd -k start 509671 508992 netdata 18172 2.1 Sl 21:37:40 /usr/libexec/netdata/plugins.d/apps.plugin 1 935481 506832 nobody 18088 0.0 S 01:22 /usr/sbin/httpd -k start 935407 506832 nobody 17916 0.0 S 01:23 /usr/sbin/httpd -k start 936978 506832 nobody 17780 0.0 S 00:37 /usr/sbin/httpd -k start 936979 506832 nobody 17780 0.0 S 00:37 /usr/sbin/httpd -k start 936438 506832 nobody 17652 0.0 S 00:54 /usr/sbin/httpd -k start 936291 506832 nobody 17648 0.0 S 00:59 /usr/sbin/httpd -k start 935479 506832 nobody 17636 0.0 S 01:22 /usr/sbin/httpd -k start 936722 506832 nobody 17636 0.0 S 00:45 /usr/sbin/httpd -k start 936412 506832 nobody 17568 0.0 S 00:55 /usr/sbin/httpd -k start 936752 506832 nobody 17476 0.0 S 00:44 /usr/sbin/httpd -k start 936330 506832 nobody 17380 0.0 S 00:58 /usr/sbin/httpd -k start 936695 506832 nobody 17320 0.1 S 00:46 /usr/sbin/httpd -k start 936505 506832 nobody 17216 0.0 S 00:52 /usr/sbin/httpd -k start 935796 506832 nobody 17212 0.0 S 01:07 /usr/sbin/httpd -k start 935352 506832 nobody 17208 0.0 S 01:26 /usr/sbin/httpd -k start 936284 506832 nobody 17196 0.0 S 00:59 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3726696 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 430 candyfabcom/candyfab.com.au-ssl_log 229 olympic/olympicfencing.com.au-ssl_log 185 alison/alisonarts.com.au-ssl_log 130 olytis/tis.com.au-ssl_log 114 vinesit/vinesit.com.au 56 infinium/infinium.net.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 26 madalice/madalice.com.au-ssl_log 18 aaa/aaadownunder.com.au-ssl_log 7 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 327 34.65.211.73 264 68.155.159.216 165 4.205.62.107 159 4.204.200.136 114 20.104.50.220 70 20.104.18.15 60 20.48.250.41 26 203.54.180.238 18 91.224.92.32 7 20.104.49.130 5 34.26.248.233 3 118.127.40.55 2 40.77.167.149 2 114.119.143.14 1 40.77.167.143 --- top request paths across all vhosts (last 3 min) --- 26 GET /heartbeat.php 6 GET /wp-login.php 5 GET /dragonshell.php 4 GET /wp-trackback.php 4 GET /w.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /goods.php 4 GET /drykl.php 4 GET /backup.php 4 GET /8.php 3 POST /wp-cron.php 3 GET /ws55.php 3 GET /wp-content/uploads/ 3 GET /wp-content/mod/adminfuns.php 3 GET /wp_blog_footer.php 3 GET /wp-aothait.php 3 GET /wp-admin/w.php 3 GET /wp-admin/maint/wp-is.php 3 GET /wp-admin/js/wp-load.php --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 2 GET /ws55.php 2 GET /w.php 2 GET /wp-content/mod/adminfuns.php 2 GET /wp_blog_footer.php 2 GET /wp-aothait.php 2 GET /wp-admin/w.php 2 GET /wp-admin/maint/wp-is.php 2 GET /wp-admin/js/wp-load.php 2 GET /wnnjpsby.php 2 GET /wefile.php 2 GET /v22.php 2 GET /tnglzqmv.php -- last 10 requests -- 4.204.200.136 - - [28/Aug/2026:23:57:02 +1000] "GET /wp-admin/js/wp-load.php HTTP/1.1" 301 - "-" "-" 4.204.200.136 - - [28/Aug/2026:23:57:03 +1000] "GET /wp-admin/js/wp-load.php HTTP/1.1" 404 27793 "-" "-" 4.204.200.136 - - [28/Aug/2026:23:57:04 +1000] "GET /robot.php HTTP/1.1" 301 - "-" "-" 4.204.200.136 - - [28/Aug/2026:23:57:05 +1000] "GET /robot.php HTTP/1.1" 404 27793 "-" "-" 4.204.200.136 - - [28/Aug/2026:23:57:06 +1000] "GET /revo.php HTTP/1.1" 301 - "-" "-" 4.204.200.136 - - [28/Aug/2026:23:57:07 +1000] "GET /revo.php HTTP/1.1" 404 27793 "-" "-" 4.204.200.136 - - [28/Aug/2026:23:57:08 +1000] "GET /birrs.php HTTP/1.1" 301 - "-" "-" 4.204.200.136 - - [28/Aug/2026:23:57:09 +1000] "GET /birrs.php HTTP/1.1" 404 27792 "-" "-" 4.204.200.136 - - [28/Aug/2026:23:57:10 +1000] "GET /sss.php?p= HTTP/1.1" 301 - "-" "-" 4.204.200.136 - - [28/Aug/2026:23:57:11 +1000] "GET /sss.php HTTP/1.1" 404 27793 "-" "-" == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-signup.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/wp-class.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/theme-compat/about.php 1 GET /wp-includes/Text/index.php -- last 10 requests -- 68.155.159.216 - - [28/Aug/2026:23:56:54 +1000] "GET /wp-content/upgrade/wp-login.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:23:56:54 +1000] "GET /wp-includes/certificates/wp-login.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:23:56:55 +1000] "GET /wp-admin/css/network.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:23:56:55 +1000] "GET /wp-cron.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:23:56:56 +1000] "GET /assets/bypass.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:23:56:56 +1000] "GET /sx.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:23:56:56 +1000] "GET /0x.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:23:56:58 +1000] "GET /wp-admin/js/ HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:23:56:59 +1000] "GET /wp-admin/images/chosen.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:23:56:59 +1000] "GET /wp-includes/wp-class.php HTTP/1.1" 401 36 "-" "-" == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 3 GET /wp-login.php 2 POST /wp-cron.php 2 HEAD / 2 GET /ueditor/ 2 GET /fckeditor/editor/ 2 GET /ewebeditor/ 2 GET /editor/tinymce/ 2 GET /doc.php 2 GET /CuteSoft_Client/ 2 GET / 1 GET /zaza.php 1 GET /xza.php -- last 10 requests -- 4.205.62.107 - - [28/Aug/2026:23:56:33 +1000] "GET /paypal.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:23:56:33 +1000] "GET /chosen.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:23:56:34 +1000] "GET /rum.or.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:23:56:35 +1000] "GET /loxi-o.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:23:56:36 +1000] "GET /luJMF.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:23:56:37 +1000] "GET /drykl.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:23:56:38 +1000] "GET /aws.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:23:56:39 +1000] "GET /05.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:23:56:40 +1000] "GET /xmy.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:23:56:41 +1000] "GET /wp-blog.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 23:54:55 L1=0.85 run=5 blk=0 avail=8899 (64.6%) swpO=0 conn=2 myRSS=2481 php=4 phpRSS=262 ap=22 tcp=38 topuser=madalice 2026-08-28 23:55:05 L1=0.95 run=4 blk=0 avail=8885 (64.5%) swpO=0 conn=3 myRSS=2481 php=4 phpRSS=294 ap=22 tcp=38 topuser=corpkicks 2026-08-28 23:55:05 L1=0.95 run=5 blk=0 avail=8876 (64.4%) swpO=0 conn=2 myRSS=2481 php=4 phpRSS=308 ap=22 tcp=36 topuser=corpkicks 2026-08-28 23:55:15 L1=1.03 run=2 blk=0 avail=8960 (65.0%) swpO=0 conn=3 myRSS=2481 php=4 phpRSS=210 ap=22 tcp=38 topuser=madalice 2026-08-28 23:55:15 L1=1.03 run=2 blk=0 avail=8943 (64.9%) swpO=0 conn=2 myRSS=2481 php=4 phpRSS=229 ap=22 tcp=38 topuser=madalice 2026-08-28 23:55:25 L1=0.95 run=1 blk=0 avail=8971 (65.1%) swpO=0 conn=1 myRSS=2481 php=4 phpRSS=210 ap=21 tcp=37 topuser=madalice 2026-08-28 23:55:25 L1=0.95 run=1 blk=0 avail=8995 (65.3%) swpO=0 conn=2 myRSS=2481 php=3 phpRSS=169 ap=21 tcp=37 topuser=madalice 2026-08-28 23:55:35 L1=0.96 run=2 blk=0 avail=9088 (66.0%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=82 ap=21 tcp=37 topuser=vinesit 2026-08-28 23:55:35 L1=0.96 run=2 blk=0 avail=9070 (65.8%) swpO=0 conn=2 myRSS=2481 php=3 phpRSS=103 ap=21 tcp=38 topuser=vinesit 2026-08-28 23:55:45 L1=1.26 run=1 blk=0 avail=8985 (65.2%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=169 ap=24 tcp=38 topuser=madalice 2026-08-28 23:55:45 L1=1.26 run=2 blk=0 avail=8955 (65.0%) swpO=0 conn=1 myRSS=2481 php=4 phpRSS=226 ap=24 tcp=36 topuser=madalice 2026-08-28 23:55:55 L1=1.15 run=2 blk=0 avail=8929 (64.8%) swpO=0 conn=1 myRSS=2481 php=4 phpRSS=251 ap=23 tcp=38 topuser=madalice 2026-08-28 23:55:55 L1=1.15 run=2 blk=0 avail=8908 (64.7%) swpO=0 conn=1 myRSS=2481 php=4 phpRSS=268 ap=23 tcp=38 topuser=madalice 2026-08-28 23:56:05 L1=1.12 run=7 blk=0 avail=8701 (63.2%) swpO=0 conn=1 myRSS=2481 php=8 phpRSS=492 ap=38 tcp=64 topuser=tubesupplies 2026-08-28 23:56:05 L1=1.12 run=5 blk=0 avail=8661 (62.9%) swpO=0 conn=1 myRSS=2481 php=7 phpRSS=507 ap=38 tcp=67 topuser=tubesupplies 2026-08-28 23:56:15 L1=1.58 run=7 blk=0 avail=8272 (60.0%) swpO=0 conn=1 myRSS=2481 php=9 phpRSS=891 ap=46 tcp=56 topuser=olympic 2026-08-28 23:56:15 L1=1.58 run=8 blk=0 avail=8182 (59.4%) swpO=0 conn=1 myRSS=2481 php=9 phpRSS=989 ap=46 tcp=55 topuser=olympic 2026-08-28 23:56:25 L1=3.82 run=47 blk=0 avail=7177 (52.1%) swpO=0 conn=29 myRSS=2481 php=44 phpRSS=2850 ap=58 tcp=209 topuser=vinesit 2026-08-28 23:56:25 L1=3.82 run=49 blk=0 avail=7050 (51.2%) swpO=0 conn=27 myRSS=2481 php=44 phpRSS=2916 ap=60 tcp=209 topuser=vinesit 2026-08-28 23:56:36 L1=10.44 run=90 blk=0 avail=5509 (40.0%) swpO=931 conn=45 myRSS=2469 php=78 phpRSS=5088 ap=106 tcp=228 topuser=vinesit 2026-08-28 23:56:38 L1=17.69 run=89 blk=0 avail=5180 (37.6%) swpO=788 conn=58 myRSS=2470 php=86 phpRSS=5446 ap=118 tcp=234 topuser=vinesit 2026-08-28 23:56:46 L1=25.32 run=121 blk=0 avail=3810 (27.7%) swpO=4071 conn=85 myRSS=2441 php=111 phpRSS=7555 ap=136 tcp=122 topuser=vinesit 2026-08-28 23:56:48 L1=33.46 run=122 blk=0 avail=3598 (26.1%) swpO=4810 conn=87 myRSS=2439 php=110 phpRSS=7914 ap=138 tcp=98 topuser=vinesit 2026-08-28 23:56:57 L1=38.07 run=12 blk=0 avail=7479 (54.3%) swpO=672 conn=85 myRSS=2444 php=10 phpRSS=1142 ap=149 tcp=98 topuser=madalice 2026-08-28 23:56:59 L1=35.26 run=5 blk=0 avail=7874 (57.2%) swpO=0 conn=87 myRSS=2444 php=7 phpRSS=664 ap=147 tcp=97 topuser=madalice 2026-08-28 23:57:07 L1=32.60 run=2 blk=0 avail=7888 (57.3%) swpO=0 conn=85 myRSS=2445 php=7 phpRSS=697 ap=139 tcp=90 topuser=madalice 2026-08-28 23:57:09 L1=30.07 run=4 blk=0 avail=7867 (57.1%) swpO=0 conn=87 myRSS=2445 php=7 phpRSS=727 ap=137 tcp=74 topuser=madalice 2026-08-28 23:57:17 L1=27.90 run=1 blk=0 avail=7956 (57.7%) swpO=0 conn=85 myRSS=2446 php=6 phpRSS=652 ap=129 tcp=37 topuser=madalice 2026-08-28 23:57:19 L1=25.67 run=1 blk=0 avail=7971 (57.9%) swpO=0 conn=87 myRSS=2446 php=6 phpRSS=652 ap=127 tcp=35 topuser=madalice 2026-08-28 23:57:27 L1=23.61 run=1 blk=0 avail=8020 (58.2%) swpO=0 conn=85 myRSS=2446 php=6 phpRSS=652 ap=119 tcp=32 topuser=madalice