INCIDENT 2026-08-31 11:07:55 trigger: php_procs=93 php_rss=3977MB mysql_conn=17 ================================================================== load: 2.95 2.85 2.80 3/830 693999 ncpu:10 mem_avail: 5786MB/13777MB (42.0%) swap_used:2042MB swapout:606/s blocked(D):0 running:2 iowait:0.2% steal:0.0% php: 93 procs / 3977MB heaviest user: evolution (91 procs, 3799MB) apache: 121 procs tcp_estab: 99 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 95 3806 mysql 1 3432 nobody 120 2119 root 249 994 netdata 7 204 madalice 1 156 mailman 20 76 cpanellogin 1 62 mailnull 3 49 dovenull 6 46 wp-toolkit 3 22 zabbix 1 20 dovecot 3 18 alison 1 15 aaa 1 13 kurri 1 12 named 1 11 nscd 1 4 polkitd 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 91 3799 madalice 1 156 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5105 MB Active(file): 4293 MB Inactive(file): 829 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 519 MB CommitLimit: 10984 MB Committed_AS: 21535 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-08:49:16 4624 /usr/bin/imunify-agent-proxy 656623 root 07:54 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3514668 8.0 Ssl 3-08:48:45 /usr/sbin/mariadbd 3036527 3002570 root 206328 0.1 S 08:36:13 spamd child 508924 1 netdata 185900 1.9 Ssl 3-08:48:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 693474 510022 madalice 160284 13.1 S 00:36 php-fpm: pool madalice_com_au 3002570 1 root 156076 0.0 Ss 08:45:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 145648 0.0 S 08:36:13 spamd child 676464 676124 evolution 68640 0.0 S 03:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692761 691537 evolution 68604 0.2 S 01:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676428 676123 evolution 67764 0.0 S 03:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676152 676132 evolution 67064 0.0 S 03:45 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 574675 1353308 cpanellogin 63604 0.0 S 32:07 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 509640 508992 root 62940 0.0 Sl 3-08:48:09 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509266 1 root 57524 0.0 Ss 3-08:48:11 /usr/lib/systemd/systemd-journald 691218 690603 evolution 43212 0.0 S 02:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676447 674419 evolution 43152 0.0 S 03:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692343 691002 evolution 43152 0.0 S 01:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691050 689265 evolution 43148 0.0 S 02:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691451 691273 evolution 43140 0.0 S 02:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676437 676122 evolution 43136 0.0 S 03:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676577 676131 evolution 43136 0.0 S 03:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692756 676555 evolution 43136 0.0 S 01:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691340 691335 evolution 43116 0.0 S 02:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692434 691510 evolution 43104 0.0 S 01:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676939 676548 evolution 43096 0.0 S 03:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693653 692494 evolution 43092 0.1 S 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691032 676112 evolution 43080 0.0 S 02:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676440 673161 evolution 43076 0.0 S 03:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676925 676542 evolution 43076 0.0 S 03:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676465 676130 evolution 43064 0.0 S 03:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692336 691540 evolution 43064 0.0 S 01:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693600 693549 evolution 43064 0.1 S 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676594 675660 evolution 43056 0.0 S 03:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 687587 676553 evolution 43032 0.0 S 02:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691572 691541 evolution 43032 0.0 S 02:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676568 676458 evolution 43024 0.0 S 03:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693634 678672 evolution 43020 0.1 S 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691204 689262 evolution 43012 0.0 S 02:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692207 691535 evolution 43012 0.0 S 01:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676982 676554 evolution 43008 0.0 S 02:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691001 662371 evolution 43008 0.0 S 02:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691366 691349 evolution 43008 0.0 S 02:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676435 676330 evolution 43004 0.0 S 03:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 686302 676929 evolution 43000 0.0 S 02:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691398 676928 evolution 43000 0.0 S 02:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693633 687743 evolution 42988 0.1 S 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676611 676549 evolution 42984 0.0 S 03:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 683762 657000 evolution 42984 0.0 S 02:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691216 671635 evolution 42984 0.0 S 02:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692468 691549 evolution 42968 0.0 S 01:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691339 691334 evolution 42964 0.0 S 02:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692300 672440 evolution 42964 0.0 S 01:39 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693764 690609 evolution 42964 0.2 S 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692332 691523 evolution 42940 0.0 S 01:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691125 676111 evolution 42932 0.0 S 02:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691170 690601 evolution 42928 0.0 S 02:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693770 693138 evolution 42928 0.2 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691062 691052 evolution 42924 0.0 S 02:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692458 691354 evolution 42912 0.0 S 01:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509236 509098 root 42872 0.0 Sl 3-08:48:11 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 692762 691508 evolution 42872 0.0 S 01:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7017945 | root | 108-1481181613 | Execute | 224 | Sending data | SELECT jobs.id, jobs.pmId, jobs.clientid, jobs.company, jobs.status, jobs.suburb, jobs.new_flag, jobs.reference, jobs.cat, jobs.dateadded, jobs.price, jobs.nextaction, jobs.repId, contacts.code, contacts.company, contacts.lastname, contacts.firstname, contacts.trading_names, jobs.site, jobs | | 7019879 | root | 108-1481181613 | Execute | 200 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019901 | root | 108-1481181613 | Execute | 199 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019910 | root | 108-1481181613 | Execute | 198 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019922 | root | 108-1481181613 | Execute | 197 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020033 | root | 108-1481181613 | Execute | 192 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and dispatch.date > date_sub(dispatch.date, interval 30 day) and jobs.status > 0 order by dispatch.statu | | 7020351 | root | 108-1481181613 | Execute | 183 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020788 | root | 108-1481181613 | Execute | 180 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7024253 | root | 108-1481181613 | Execute | 145 | Waiting for table level lock | SELECT count(timesheets.id) as c FROM timesheets LEFT JOIN jobs ON jobs.id = timesheets.jobid LEFT JOIN invoices ON invoices.id = timesheets.invoiced LEFT JOIN staff ON staff.id = timesheets.approved_by WHERE (1 = 1) AND timesheets.jobid IN (0) AND (timesheets.type = 0) AND opportunityid = '8540 | | 7024261 | root | 108-1481181613 | Execute | 143 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7024690 | root | 108-1481181613 | Execute | 137 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7025229 | root | 108-1481181613 | Execute | 132 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7025856 | root | 108-1481181613 | Execute | 126 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='6' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 7031538 | root | 108-1481181613 | Execute | 62 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts WHERE clientid = jobs.clientid) as company FROM retentions INNER JOIN jobs ON jo | | 7031972 | root | 108-1481181613 | Execute | 57 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 7036897 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7019879 | 108-1481181613 | 200 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019901 | 108-1481181613 | 199 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019910 | 108-1481181613 | 198 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019922 | 108-1481181613 | 197 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7020033 | 108-1481181613 | 192 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and disp | | 7020351 | 108-1481181613 | 183 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7020788 | 108-1481181613 | 180 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7024253 | 108-1481181613 | 145 | Waiting for table level lock | SELECT count(timesheets.id) as c FROM timesheets LEFT JOIN jobs ON jobs.id = timesheets.jobid LEFT JOIN invoices ON invoices.id = timesheets.invoiced LEFT JOIN staff ON staff.id = timesheets.approved_ | | 7024261 | 108-1481181613 | 143 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7024690 | 108-1481181613 | 137 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7025229 | 108-1481181613 | 132 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7025856 | 108-1481181613 | 126 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='6' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 7031538 | 108-1481181613 | 62 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts W | | 7031972 | 108-1481181613 | 57 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 522 madalice/madalice.com.au-ssl_log 223 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 92 olympic/seb-mobile-auth.olympicfencing.com.au 90 speedlin/speedlinefencing.com.au-ssl_log 79 customc/customcentral.com.au-ssl_log 77 alison/alisonarts.com.au-ssl_log 75 evolution/portal.evolutionerp.com.au-ssl_log 46 aaa/aaadownunder.com.au-ssl_log 22 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 189 20.48.251.3 182 20.104.49.130 179 103.104.165.99 97 120.150.225.142 77 195.178.110.102 76 182.239.240.254 73 52.139.44.162 72 4.204.224.164 71 103.104.164.114 58 203.54.180.238 37 101.166.96.210 29 103.253.27.105 18 1.144.107.82 14 150.228.243.152 12 182.9.48.59 --- top request paths across all vhosts (last 3 min) --- 137 POST /functions.php 118 GET /app/ajax.php 48 GET /index.php 41 POST //functions.php 38 GET /heartbeat.php 34 POST /clienteditsave.php 21 POST /app/ajax.php 18 POST /app/ajax/selectFilterSingle.php 15 POST /wp/ 15 POST /plugins/csvexporter/plugin.php 14 POST /jobeditsave.php 12 POST /wp/index.php 12 GET / 10 POST /logsave.php 9 POST /wp-json/ymc/v1/posts/filter 8 POST /quoteditsave.php 8 POST /dispatchsave.php 8 POST / 7 POST /plugins/fencecosting/plugin.php 6 POST /wp//wp-json/batch/v1 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 137 POST /functions.php 118 GET /app/ajax.php 47 GET /index.php 41 POST //functions.php 34 POST /clienteditsave.php 21 POST /app/ajax.php 18 POST /app/ajax/selectFilterSingle.php 15 POST /plugins/csvexporter/plugin.php 14 POST /jobeditsave.php 10 POST /logsave.php 8 POST /quoteditsave.php 8 POST /dispatchsave.php -- last 10 requests -- 103.104.164.114 - - [31/Aug/2026:11:07:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [31/Aug/2026:11:07:48 +1000] "GET /index.php?page=jobedit&id=12061 HTTP/1.1" 200 199788 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 103.104.165.99 - - [31/Aug/2026:11:07:49 +1000] "POST /logsave.php?call=getHistory&id=12061&module=job HTTP/1.1" 200 620 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12061" "Mozilla/5.0 (Windows NT 10.0; Win 103.104.165.99 - - [31/Aug/2026:11:07:49 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12061" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.165.99 - - [31/Aug/2026:11:07:49 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12061" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.165.99 - - [31/Aug/2026:11:07:49 +1000] "POST /clienteditsave.php?clientid=3565&call=getCategoryDiscounts HTTP/1.1" 200 256 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12061" "Mozilla/5.0 (Windows N 103.104.165.99 - - [31/Aug/2026:11:07:50 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14055123667 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 103.104.165.99 - - [31/Aug/2026:11:07:49 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12061" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 103.104.165.99 - - [31/Aug/2026:11:07:50 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=19961248819 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 103.104.165.99 - - [31/Aug/2026:11:07:50 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D12061&call=getUserSetting&caller=ajaxSubmitLocal&seq=11902506594 HTTP/1.1" 200 112 "https://my. == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET // 3 GET / 2 GET //xmlrpc.php 2 GET //wp-includes/wlwmanifest.xml 2 GET /store/custom-st-george-dragons-kids/ 2 GET /ms-edit.php 2 GET /doc.php 1 POST //xmlrpc.php 1 POST //wp-login.php 1 POST / 1 GET /zz.php 1 GET /zaza.php -- last 10 requests -- 20.48.251.3 - - [31/Aug/2026:11:05:53 +1000] "GET /txets.php HTTP/1.1" 403 13 "-" "-" 20.48.251.3 - - [31/Aug/2026:11:05:54 +1000] "GET /time.php HTTP/1.1" 401 53 "-" "-" 20.48.251.3 - - [31/Aug/2026:11:05:54 +1000] "GET /doc.php HTTP/1.1" 401 53 "-" "-" 20.48.251.3 - - [31/Aug/2026:11:05:55 +1000] "GET /classsmtps.php HTTP/1.1" 401 53 "-" "-" 20.48.251.3 - - [31/Aug/2026:11:05:55 +1000] "GET /cache-compat.php HTTP/1.1" 401 53 "-" "-" 20.48.251.3 - - [31/Aug/2026:11:05:55 +1000] "GET /aws_keys.php HTTP/1.1" 401 53 "-" "-" 20.48.251.3 - - [31/Aug/2026:11:05:56 +1000] "GET /umgebung.php HTTP/1.1" 401 53 "-" "-" 20.48.251.3 - - [31/Aug/2026:11:05:56 +1000] "GET /old_phpinfo.php HTTP/1.1" 403 12 "-" "-" 20.48.251.3 - - [31/Aug/2026:11:05:56 +1000] "GET /wp-act.php HTTP/1.1" 401 53 "-" "-" 114.119.140.234 - - [31/Aug/2026:11:06:00 +1000] "GET /store/custom-shapeshifter/?wcpr_verified=1&wcpr_rating=5&wcpr_image=1&wcpr_page=2 HTTP/1.1" 404 36666 "https://madalice.com.au/store/custom-shapeshifter/?wcpr_verifi == olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log == -- top paths -- 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /un.php 1 GET /this_is_a_new_hello_world.php 1 GET /tesla1.php 1 GET /t7cyZd.php 1 GET /swm.php 1 GET /ss.php 1 GET /sid3.php 1 GET /shop.php 1 GET /shiny.php 1 GET /send.php 1 GET /search.php -- last 10 requests -- 20.104.49.130 - - [31/Aug/2026:11:05:45 +1000] "GET /nfile.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [31/Aug/2026:11:05:45 +1000] "GET /alfanew2.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [31/Aug/2026:11:05:46 +1000] "GET /ss.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [31/Aug/2026:11:05:46 +1000] "GET /mariju.php HTTP/1.1" 403 13 "-" "-" 20.104.49.130 - - [31/Aug/2026:11:05:47 +1000] "GET /metamers.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [31/Aug/2026:11:05:47 +1000] "GET /11.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [31/Aug/2026:11:05:48 +1000] "GET /kct403.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [31/Aug/2026:11:05:48 +1000] "GET /fox.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [31/Aug/2026:11:05:48 +1000] "GET /f7.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [31/Aug/2026:11:05:49 +1000] "GET /bypass.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-31 11:05:33 L1=2.68 run=3 blk=0 avail=6725 (48.8%) swpO=3 conn=13 myRSS=3441 php=48 phpRSS=2127 ap=75 tcp=76 topuser=evolution 2026-08-31 11:05:33 L1=2.68 run=5 blk=0 avail=6625 (48.1%) swpO=3 conn=15 myRSS=3441 php=50 phpRSS=2269 ap=76 tcp=78 topuser=evolution 2026-08-31 11:05:43 L1=2.73 run=5 blk=0 avail=6314 (45.8%) swpO=0 conn=15 myRSS=3442 php=60 phpRSS=2729 ap=86 tcp=85 topuser=evolution 2026-08-31 11:05:44 L1=2.73 run=4 blk=0 avail=6395 (46.4%) swpO=0 conn=15 myRSS=3442 php=57 phpRSS=2618 ap=87 tcp=95 topuser=evolution 2026-08-31 11:05:53 L1=2.55 run=4 blk=0 avail=6059 (44.0%) swpO=0 conn=17 myRSS=3444 php=62 phpRSS=2893 ap=116 tcp=88 topuser=evolution 2026-08-31 11:05:54 L1=2.55 run=8 blk=0 avail=5979 (43.4%) swpO=0 conn=17 myRSS=3444 php=62 phpRSS=2964 ap=115 tcp=87 topuser=evolution 2026-08-31 11:06:04 L1=2.76 run=4 blk=0 avail=6210 (45.1%) swpO=0 conn=15 myRSS=3445 php=61 phpRSS=2775 ap=105 tcp=82 topuser=evolution 2026-08-31 11:06:04 L1=2.94 run=5 blk=0 avail=6211 (45.1%) swpO=0 conn=16 myRSS=3445 php=62 phpRSS=2821 ap=105 tcp=81 topuser=evolution 2026-08-31 11:06:14 L1=2.95 run=6 blk=0 avail=6245 (45.3%) swpO=0 conn=18 myRSS=3447 php=65 phpRSS=2908 ap=97 tcp=101 topuser=evolution 2026-08-31 11:06:14 L1=2.95 run=7 blk=0 avail=6237 (45.3%) swpO=0 conn=18 myRSS=3447 php=64 phpRSS=2877 ap=97 tcp=95 topuser=evolution 2026-08-31 11:06:24 L1=2.96 run=5 blk=0 avail=6184 (44.9%) swpO=0 conn=14 myRSS=3448 php=70 phpRSS=3084 ap=98 tcp=90 topuser=evolution 2026-08-31 11:06:24 L1=2.96 run=3 blk=0 avail=6307 (45.8%) swpO=0 conn=14 myRSS=3448 php=68 phpRSS=2923 ap=98 tcp=90 topuser=evolution 2026-08-31 11:06:34 L1=2.96 run=3 blk=0 avail=6211 (45.1%) swpO=0 conn=14 myRSS=3450 php=72 phpRSS=3108 ap=101 tcp=93 topuser=evolution 2026-08-31 11:06:34 L1=2.96 run=2 blk=0 avail=6199 (45.0%) swpO=0 conn=14 myRSS=3450 php=73 phpRSS=3147 ap=101 tcp=93 topuser=evolution 2026-08-31 11:06:44 L1=2.89 run=3 blk=0 avail=6137 (44.5%) swpO=3 conn=15 myRSS=3452 php=75 phpRSS=3278 ap=99 tcp=80 topuser=evolution 2026-08-31 11:06:44 L1=2.89 run=3 blk=0 avail=6128 (44.5%) swpO=3 conn=14 myRSS=3452 php=75 phpRSS=3285 ap=99 tcp=80 topuser=evolution 2026-08-31 11:06:54 L1=2.68 run=4 blk=0 avail=6127 (44.5%) swpO=0 conn=15 myRSS=3453 php=79 phpRSS=3377 ap=106 tcp=97 topuser=evolution 2026-08-31 11:06:54 L1=2.68 run=4 blk=0 avail=6148 (44.6%) swpO=0 conn=17 myRSS=3453 php=78 phpRSS=3288 ap=106 tcp=95 topuser=evolution 2026-08-31 11:07:04 L1=2.96 run=4 blk=0 avail=5785 (42.0%) swpO=467 conn=18 myRSS=3444 php=82 phpRSS=3738 ap=110 tcp=87 topuser=evolution 2026-08-31 11:07:05 L1=2.96 run=2 blk=0 avail=6056 (44.0%) swpO=425 conn=17 myRSS=3444 php=80 phpRSS=3433 ap=110 tcp=91 topuser=evolution 2026-08-31 11:07:14 L1=2.74 run=3 blk=0 avail=6004 (43.6%) swpO=0 conn=18 myRSS=3446 php=83 phpRSS=3576 ap=108 tcp=89 topuser=evolution 2026-08-31 11:07:15 L1=2.74 run=4 blk=0 avail=5998 (43.5%) swpO=0 conn=18 myRSS=3446 php=83 phpRSS=3580 ap=108 tcp=89 topuser=evolution 2026-08-31 11:07:24 L1=3.24 run=4 blk=0 avail=5958 (43.2%) swpO=0 conn=18 myRSS=3448 php=84 phpRSS=3611 ap=112 tcp=95 topuser=evolution 2026-08-31 11:07:25 L1=3.24 run=2 blk=0 avail=5951 (43.2%) swpO=0 conn=17 myRSS=3448 php=83 phpRSS=3571 ap=116 tcp=92 topuser=evolution 2026-08-31 11:07:34 L1=3.05 run=3 blk=0 avail=5810 (42.2%) swpO=0 conn=18 myRSS=3449 php=91 phpRSS=3915 ap=118 tcp=92 topuser=evolution 2026-08-31 11:07:35 L1=3.05 run=3 blk=0 avail=5781 (42.0%) swpO=0 conn=18 myRSS=3449 php=91 phpRSS=3942 ap=118 tcp=92 topuser=evolution 2026-08-31 11:07:45 L1=3.04 run=4 blk=0 avail=5699 (41.4%) swpO=0 conn=19 myRSS=3451 php=95 phpRSS=4140 ap=118 tcp=98 topuser=evolution 2026-08-31 11:07:45 L1=3.04 run=4 blk=0 avail=5667 (41.1%) swpO=0 conn=17 myRSS=3451 php=95 phpRSS=4168 ap=118 tcp=98 topuser=evolution 2026-08-31 11:07:55 L1=2.95 run=2 blk=0 avail=5786 (42.0%) swpO=606 conn=17 myRSS=3432 php=93 phpRSS=3977 ap=121 tcp=99 topuser=evolution 2026-08-31 11:07:55 L1=2.95 run=5 blk=0 avail=5783 (42.0%) swpO=606 conn=17 myRSS=3432 php=93 phpRSS=3977 ap=121 tcp=94 topuser=evolution