INCIDENT 2026-08-31 11:08:55 trigger: php_procs=110 php_rss=4793MB mysql_conn=18 ================================================================== load: 2.45 2.70 2.75 4/868 695098 ncpu:10 mem_avail: 5269MB/13777MB (38.2%) swap_used:2049MB swapout:0/s blocked(D):0 running:7 iowait:0.2% steal:0.0% php: 110 procs / 4793MB heaviest user: evolution (107 procs, 4454MB) apache: 137 procs tcp_estab: 101 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 111 4462 mysql 1 3426 nobody 136 2367 root 250 1070 madalice 2 316 netdata 7 205 mailnull 6 91 mailman 20 75 cpanellogin 1 61 dovenull 6 46 wp-toolkit 3 22 zabbix 1 19 dovecot 3 18 alison 1 15 kurri 1 12 named 1 11 nscd 1 4 polkitd 1 3 dbus 1 2 cpanelconnecttrack 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 108 4488 madalice 2 316 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4722 MB Active(file): 3742 MB Inactive(file): 890 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 517 MB CommitLimit: 10984 MB Committed_AS: 24538 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-08:50:16 4592 /usr/bin/imunify-agent-proxy 656623 root 08:54 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3509108 8.0 Ssl 3-08:49:45 /usr/sbin/mariadbd 3036527 3002570 root 206200 0.1 S 08:37:13 spamd child 508924 1 netdata 186272 1.9 Ssl 3-08:49:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 694920 510022 madalice 162780 34.0 S 00:14 php-fpm: pool madalice_com_au 693474 510022 madalice 161168 15.2 S 01:36 php-fpm: pool madalice_com_au 3002570 1 root 154996 0.0 Ss 08:46:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 144656 0.0 S 08:37:13 spamd child 676464 676124 evolution 68640 0.0 S 04:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692761 691537 evolution 68604 0.1 S 02:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676428 676123 evolution 67764 0.0 S 04:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676152 676132 evolution 67064 0.0 S 04:45 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 574675 1353308 cpanellogin 63364 0.0 S 33:07 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 509640 508992 root 62940 0.0 Sl 3-08:49:09 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509266 1 root 57524 0.0 Ss 3-08:49:11 /usr/lib/systemd/systemd-journald 695051 695044 root 50952 0.0 R 00:00 /usr/local/cpanel/3rdparty/bin/perl /usr/sbin/csf -d 162.55.102.189 lfd: (sshd) Failed SSH login from 162.55.102.189 (static.189.102.55 691218 690603 evolution 43212 0.0 S 03:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694997 693466 evolution 43176 0.5 S 00:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676447 674419 evolution 43152 0.0 S 04:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692343 691002 evolution 43152 0.0 S 02:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691050 689265 evolution 43148 0.0 S 03:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691451 691273 evolution 43140 0.0 S 03:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676437 676122 evolution 43136 0.0 S 04:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676577 676131 evolution 43136 0.0 S 04:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692756 676555 evolution 43136 0.0 S 02:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691340 691335 evolution 43116 0.0 S 03:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694453 691536 evolution 43112 0.0 S 00:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692434 691510 evolution 43104 0.0 S 02:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676939 676548 evolution 43096 0.0 S 04:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693653 692494 evolution 43092 0.0 S 01:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694540 676442 evolution 43088 0.0 S 00:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691032 676112 evolution 43080 0.0 S 03:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694652 693095 evolution 43080 0.1 S 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676440 673161 evolution 43076 0.0 S 04:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676925 676542 evolution 43076 0.0 S 04:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695022 694889 evolution 43076 0.7 S 00:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676465 676130 evolution 43064 0.0 S 04:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692336 691540 evolution 43064 0.0 S 02:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693600 693549 evolution 43064 0.0 S 01:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676594 675660 evolution 43056 0.0 S 04:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 687587 676553 evolution 43032 0.0 S 03:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691572 691541 evolution 43032 0.0 S 03:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676568 676458 evolution 43024 0.0 S 04:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693634 678672 evolution 43020 0.0 S 01:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691204 689262 evolution 43012 0.0 S 03:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692207 691535 evolution 43012 0.0 S 02:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676982 676554 evolution 43008 0.0 S 03:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691001 662371 evolution 43008 0.0 S 03:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691366 691349 evolution 43008 0.0 S 03:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676435 676330 evolution 43004 0.0 S 04:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 686302 676929 evolution 43000 0.0 S 03:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691398 676928 evolution 43000 0.0 S 03:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693633 687743 evolution 42988 0.0 S 01:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676611 676549 evolution 42984 0.0 S 04:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 683762 657000 evolution 42984 0.0 S 03:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691216 671635 evolution 42984 0.0 S 03:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692468 691549 evolution 42968 0.0 S 02:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691339 691334 evolution 42964 0.0 S 03:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692300 672440 evolution 42964 0.0 S 02:39 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693764 690609 evolution 42964 0.0 S 01:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692332 691523 evolution 42940 0.0 S 02:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7017945 | root | 108-1481181613 | Execute | 285 | Sending data | SELECT jobs.id, jobs.pmId, jobs.clientid, jobs.company, jobs.status, jobs.suburb, jobs.new_flag, jobs.reference, jobs.cat, jobs.dateadded, jobs.price, jobs.nextaction, jobs.repId, contacts.code, contacts.company, contacts.lastname, contacts.firstname, contacts.trading_names, jobs.site, jobs | | 7019879 | root | 108-1481181613 | Execute | 261 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019910 | root | 108-1481181613 | Execute | 259 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019901 | root | 108-1481181613 | Execute | 259 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019922 | root | 108-1481181613 | Execute | 258 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020033 | root | 108-1481181613 | Execute | 253 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and dispatch.date > date_sub(dispatch.date, interval 30 day) and jobs.status > 0 order by dispatch.statu | | 7020351 | root | 108-1481181613 | Execute | 244 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020788 | root | 108-1481181613 | Execute | 241 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7024253 | root | 108-1481181613 | Execute | 206 | Waiting for table level lock | SELECT count(timesheets.id) as c FROM timesheets LEFT JOIN jobs ON jobs.id = timesheets.jobid LEFT JOIN invoices ON invoices.id = timesheets.invoiced LEFT JOIN staff ON staff.id = timesheets.approved_by WHERE (1 = 1) AND timesheets.jobid IN (0) AND (timesheets.type = 0) AND opportunityid = '8540 | | 7024261 | root | 108-1481181613 | Execute | 204 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7024690 | root | 108-1481181613 | Execute | 197 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7025229 | root | 108-1481181613 | Execute | 193 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7025856 | root | 108-1481181613 | Execute | 187 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='6' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 7031538 | root | 108-1481181613 | Execute | 123 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts WHERE clientid = jobs.clientid) as company FROM retentions INNER JOIN jobs ON jo | | 7031972 | root | 108-1481181613 | Execute | 118 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 7038985 | root | 108-1481181613 | Execute | 7 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7039731 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7019879 | 108-1481181613 | 261 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019910 | 108-1481181613 | 259 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019901 | 108-1481181613 | 259 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019922 | 108-1481181613 | 258 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7020033 | 108-1481181613 | 253 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and disp | | 7020351 | 108-1481181613 | 244 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7020788 | 108-1481181613 | 241 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7024253 | 108-1481181613 | 206 | Waiting for table level lock | SELECT count(timesheets.id) as c FROM timesheets LEFT JOIN jobs ON jobs.id = timesheets.jobid LEFT JOIN invoices ON invoices.id = timesheets.invoiced LEFT JOIN staff ON staff.id = timesheets.approved_ | | 7024261 | 108-1481181613 | 204 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7024690 | 108-1481181613 | 197 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7025229 | 108-1481181613 | 193 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7025856 | 108-1481181613 | 187 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='6' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 7031538 | 108-1481181613 | 123 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts W | | 7031972 | 108-1481181613 | 118 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 7038985 | 108-1481181613 | 7 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 516 alison/alisonarts.com.au-ssl_log 115 customc/customcentral.com.au-ssl_log 75 speedlin/speedlinefencing.com.au-ssl_log 54 evolution/portal.evolutionerp.com.au-ssl_log 33 madalice/madalice.com.au-ssl_log 29 aaa/aaadownunder.com.au-ssl_log 9 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 246 103.104.165.99 115 4.204.224.164 73 52.139.44.162 68 120.150.225.142 61 182.239.240.254 54 195.178.110.102 42 103.104.164.114 41 203.54.180.238 36 101.166.96.210 26 150.228.243.152 19 103.253.27.55 9 182.9.48.59 9 147.161.213.71 5 147.161.215.103 5 1.144.107.82 --- top request paths across all vhosts (last 3 min) --- 132 POST /functions.php 107 GET /app/ajax.php 48 GET /index.php 45 POST //functions.php 32 GET /heartbeat.php 27 POST /clienteditsave.php 26 POST /plugins/csvexporter/plugin.php 19 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 14 POST /wp/ 11 POST /jobeditsave.php 10 POST /wp/index.php 9 POST /wp-json/ymc/v1/posts/filter 8 POST /plugins/fencecosting/plugin.php 8 POST /logsave.php 8 POST //inveditsave.php 7 POST /mfreqsave.php 6 POST /dispatchsave.php 6 HEAD /index.php 6 GET //app/ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 132 POST /functions.php 107 GET /app/ajax.php 48 GET /index.php 45 POST //functions.php 27 POST /clienteditsave.php 26 POST /plugins/csvexporter/plugin.php 19 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 11 POST /jobeditsave.php 8 POST /plugins/fencecosting/plugin.php 8 POST /logsave.php 8 POST //inveditsave.php -- last 10 requests -- 150.228.243.152 - - [31/Aug/2026:11:08:53 +1000] "POST /inveditsave.php?save=1 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2208&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap 150.228.243.152 - - [31/Aug/2026:11:08:53 +1000] "GET /index.php?page=invedit&id=2208&tab=generaltab HTTP/1.1" 200 34675 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2208&tab=generaltab" "Mozilla/5.0 (Window 103.104.164.114 - - [31/Aug/2026:11:08:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [31/Aug/2026:11:08:53 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12061&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 150.228.243.152 - - [31/Aug/2026:11:08:53 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2208&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [31/Aug/2026:11:08:53 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au//index.php?page=invedit&id=6450&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 150.228.243.152 - - [31/Aug/2026:11:08:54 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D2208%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=16219209928 HTTP/1.1" 200 109 "https://my 103.104.165.99 - - [31/Aug/2026:11:08:54 +1000] "POST //inveditsave.php?save=1 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au//index.php?page=invedit&id=6450&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) A 103.104.165.99 - - [31/Aug/2026:11:08:54 +1000] "GET /index.php?page=invedit&id=6450&tab=generaltab HTTP/1.1" 200 36892 "https://my.evolutionerp.com.au//index.php?page=invedit&id=6450&tab=generaltab" "Mozilla/5.0 (Window 103.104.165.99 - - [31/Aug/2026:11:08:54 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6450&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 GET /admin.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-mails.php 1 GET /wp-includes/Requests/ 1 GET /wp-includes/ID3/about.php 1 GET /wp-includes/blocks/details/ -- last 10 requests -- 4.204.224.164 - - [31/Aug/2026:11:07:51 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:51 +1000] "GET /wp-admin/css/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:51 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:52 +1000] "GET /wp-includes/blocks/details/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:52 +1000] "GET /wp-includes/blocks/audio/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:53 +1000] "GET /wp-temp.php HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:53 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:54 +1000] "GET /wp-includes/Requests/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:54 +1000] "GET /wp-content/admin.php HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:54 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 5749 "-" "-" == customc/customcentral.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 GET /zoo1.php 1 GET /x.php 1 GET /xmini4.php 1 GET /xc.php 1 GET /wsd.php 1 GET /ws55.php 1 GET /wp-sitemap-taxonomies-category-1.xml 1 GET /wp.php 1 GET /wp-load.php 1 GET /wp-includes/index.php 1 GET /w.php -- last 10 requests -- 52.139.44.162 - - [31/Aug/2026:11:07:02 +1000] "GET /wp_blog_footer.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [31/Aug/2026:11:07:03 +1000] "GET /wefile.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [31/Aug/2026:11:07:03 +1000] "GET /wp-load.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [31/Aug/2026:11:07:04 +1000] "GET /robot.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [31/Aug/2026:11:07:04 +1000] "GET /sss.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [31/Aug/2026:11:07:05 +1000] "GET /xmini4.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [31/Aug/2026:11:07:05 +1000] "GET /gulu.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [31/Aug/2026:11:07:06 +1000] "GET /replace.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [31/Aug/2026:11:07:06 +1000] "GET /c4.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [31/Aug/2026:11:07:07 +1000] "GET /rxr.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-31 11:06:34 L1=2.96 run=3 blk=0 avail=6211 (45.1%) swpO=0 conn=14 myRSS=3450 php=72 phpRSS=3108 ap=101 tcp=93 topuser=evolution 2026-08-31 11:06:34 L1=2.96 run=2 blk=0 avail=6199 (45.0%) swpO=0 conn=14 myRSS=3450 php=73 phpRSS=3147 ap=101 tcp=93 topuser=evolution 2026-08-31 11:06:44 L1=2.89 run=3 blk=0 avail=6137 (44.5%) swpO=3 conn=15 myRSS=3452 php=75 phpRSS=3278 ap=99 tcp=80 topuser=evolution 2026-08-31 11:06:44 L1=2.89 run=3 blk=0 avail=6128 (44.5%) swpO=3 conn=14 myRSS=3452 php=75 phpRSS=3285 ap=99 tcp=80 topuser=evolution 2026-08-31 11:06:54 L1=2.68 run=4 blk=0 avail=6127 (44.5%) swpO=0 conn=15 myRSS=3453 php=79 phpRSS=3377 ap=106 tcp=97 topuser=evolution 2026-08-31 11:06:54 L1=2.68 run=4 blk=0 avail=6148 (44.6%) swpO=0 conn=17 myRSS=3453 php=78 phpRSS=3288 ap=106 tcp=95 topuser=evolution 2026-08-31 11:07:04 L1=2.96 run=4 blk=0 avail=5785 (42.0%) swpO=467 conn=18 myRSS=3444 php=82 phpRSS=3738 ap=110 tcp=87 topuser=evolution 2026-08-31 11:07:05 L1=2.96 run=2 blk=0 avail=6056 (44.0%) swpO=425 conn=17 myRSS=3444 php=80 phpRSS=3433 ap=110 tcp=91 topuser=evolution 2026-08-31 11:07:14 L1=2.74 run=3 blk=0 avail=6004 (43.6%) swpO=0 conn=18 myRSS=3446 php=83 phpRSS=3576 ap=108 tcp=89 topuser=evolution 2026-08-31 11:07:15 L1=2.74 run=4 blk=0 avail=5998 (43.5%) swpO=0 conn=18 myRSS=3446 php=83 phpRSS=3580 ap=108 tcp=89 topuser=evolution 2026-08-31 11:07:24 L1=3.24 run=4 blk=0 avail=5958 (43.2%) swpO=0 conn=18 myRSS=3448 php=84 phpRSS=3611 ap=112 tcp=95 topuser=evolution 2026-08-31 11:07:25 L1=3.24 run=2 blk=0 avail=5951 (43.2%) swpO=0 conn=17 myRSS=3448 php=83 phpRSS=3571 ap=116 tcp=92 topuser=evolution 2026-08-31 11:07:34 L1=3.05 run=3 blk=0 avail=5810 (42.2%) swpO=0 conn=18 myRSS=3449 php=91 phpRSS=3915 ap=118 tcp=92 topuser=evolution 2026-08-31 11:07:35 L1=3.05 run=3 blk=0 avail=5781 (42.0%) swpO=0 conn=18 myRSS=3449 php=91 phpRSS=3942 ap=118 tcp=92 topuser=evolution 2026-08-31 11:07:45 L1=3.04 run=4 blk=0 avail=5699 (41.4%) swpO=0 conn=19 myRSS=3451 php=95 phpRSS=4140 ap=118 tcp=98 topuser=evolution 2026-08-31 11:07:45 L1=3.04 run=4 blk=0 avail=5667 (41.1%) swpO=0 conn=17 myRSS=3451 php=95 phpRSS=4168 ap=118 tcp=98 topuser=evolution 2026-08-31 11:07:55 L1=2.95 run=2 blk=0 avail=5786 (42.0%) swpO=606 conn=17 myRSS=3432 php=93 phpRSS=3977 ap=121 tcp=99 topuser=evolution 2026-08-31 11:07:55 L1=2.95 run=5 blk=0 avail=5783 (42.0%) swpO=606 conn=17 myRSS=3432 php=93 phpRSS=3977 ap=121 tcp=94 topuser=evolution 2026-08-31 11:08:05 L1=2.72 run=2 blk=0 avail=5727 (41.6%) swpO=0 conn=18 myRSS=3432 php=95 phpRSS=4077 ap=121 tcp=99 topuser=evolution 2026-08-31 11:08:05 L1=2.72 run=4 blk=0 avail=5713 (41.5%) swpO=0 conn=18 myRSS=3432 php=95 phpRSS=4093 ap=121 tcp=101 topuser=evolution 2026-08-31 11:08:15 L1=2.46 run=2 blk=0 avail=5812 (42.2%) swpO=0 conn=17 myRSS=3432 php=94 phpRSS=4018 ap=115 tcp=89 topuser=evolution 2026-08-31 11:08:15 L1=2.46 run=2 blk=0 avail=5811 (42.2%) swpO=0 conn=17 myRSS=3432 php=94 phpRSS=4018 ap=115 tcp=89 topuser=evolution 2026-08-31 11:08:25 L1=2.31 run=4 blk=0 avail=5659 (41.1%) swpO=139 conn=17 myRSS=3428 php=98 phpRSS=4182 ap=128 tcp=99 topuser=evolution 2026-08-31 11:08:25 L1=2.31 run=3 blk=0 avail=5671 (41.2%) swpO=139 conn=17 myRSS=3428 php=98 phpRSS=4182 ap=128 tcp=99 topuser=evolution 2026-08-31 11:08:35 L1=2.18 run=6 blk=0 avail=5483 (39.8%) swpO=0 conn=19 myRSS=3428 php=105 phpRSS=4614 ap=122 tcp=102 topuser=evolution 2026-08-31 11:08:35 L1=2.18 run=11 blk=0 avail=5450 (39.6%) swpO=0 conn=19 myRSS=3428 php=106 phpRSS=4693 ap=122 tcp=103 topuser=evolution 2026-08-31 11:08:45 L1=2.53 run=4 blk=0 avail=5316 (38.6%) swpO=44 conn=18 myRSS=3426 php=104 phpRSS=4586 ap=147 tcp=96 topuser=evolution 2026-08-31 11:08:45 L1=2.53 run=6 blk=0 avail=5290 (38.4%) swpO=44 conn=18 myRSS=3426 php=104 phpRSS=4613 ap=147 tcp=96 topuser=evolution 2026-08-31 11:08:55 L1=2.45 run=7 blk=0 avail=5269 (38.2%) swpO=0 conn=18 myRSS=3426 php=110 phpRSS=4793 ap=137 tcp=101 topuser=evolution 2026-08-31 11:08:55 L1=2.45 run=4 blk=0 avail=5266 (38.2%) swpO=0 conn=18 myRSS=3426 php=110 phpRSS=4793 ap=137 tcp=101 topuser=evolution