INCIDENT 2026-08-31 11:09:56 trigger: php_procs=121 php_rss=5239MB mysql_conn=20 ================================================================== load: 1.90 2.50 2.68 2/880 695955 ncpu:10 mem_avail: 5157MB/13777MB (37.4%) swap_used:2084MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 121 procs / 5239MB heaviest user: evolution (118 procs, 4928MB) apache: 144 procs tcp_estab: 104 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 122 4936 mysql 1 3399 nobody 143 2527 root 250 955 madalice 2 288 netdata 7 205 mailman 20 75 cpanellogin 1 61 dovenull 6 46 mailnull 2 30 wp-toolkit 3 21 zabbix 1 19 dovecot 3 18 alison 1 15 kurri 1 12 named 1 11 sshd 1 4 nscd 1 4 polkitd 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 118 4928 madalice 2 288 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4578 MB Active(file): 3378 MB Inactive(file): 1053 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 508 MB CommitLimit: 10984 MB Committed_AS: 25948 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-08:51:17 4516 /usr/bin/imunify-agent-proxy 656623 root 09:55 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3480700 8.0 Ssl 3-08:50:46 /usr/sbin/mariadbd 3036527 3002570 root 201412 0.1 S 08:38:14 spamd child 508924 1 netdata 186084 1.9 Ssl 3-08:50:15 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 695709 510022 madalice 159096 23.0 S 00:22 php-fpm: pool madalice_com_au 3002570 1 root 147664 0.0 Ss 08:47:10 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 137360 0.0 S 08:38:14 spamd child 695824 510022 madalice 136092 9.1 S 00:14 php-fpm: pool madalice_com_au 695548 694740 evolution 68796 0.3 S 00:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676464 676124 evolution 68640 0.0 S 05:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692761 691537 evolution 68604 0.0 S 03:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676428 676123 evolution 67764 0.0 S 05:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676152 676132 evolution 67064 0.0 S 05:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 574675 1353308 cpanellogin 63184 0.0 S 34:08 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 509640 508992 root 62932 0.0 Sl 3-08:50:10 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509266 1 root 57956 0.0 Ss 3-08:50:12 /usr/lib/systemd/systemd-journald 691218 690603 evolution 43212 0.0 S 04:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694997 693466 evolution 43176 0.0 S 01:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676447 674419 evolution 43152 0.0 S 05:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692343 691002 evolution 43152 0.0 S 03:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691050 689265 evolution 43148 0.0 S 04:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691451 691273 evolution 43140 0.0 S 04:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676437 676122 evolution 43136 0.0 S 05:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676577 676131 evolution 43136 0.0 S 05:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692756 676555 evolution 43136 0.0 S 03:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695696 695671 evolution 43120 0.2 S 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691340 691335 evolution 43116 0.0 S 04:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694453 691536 evolution 43112 0.0 S 01:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695348 694911 evolution 43108 0.0 S 00:58 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692434 691510 evolution 43104 0.0 S 03:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676939 676548 evolution 43096 0.0 S 05:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693653 692494 evolution 43092 0.0 S 02:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694540 676442 evolution 43088 0.0 S 01:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691032 676112 evolution 43080 0.0 S 04:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694652 693095 evolution 43080 0.0 S 01:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676440 673161 evolution 43076 0.0 S 05:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676925 676542 evolution 43076 0.0 S 05:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695022 694889 evolution 43076 0.0 S 01:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695396 694561 evolution 43068 0.0 S 00:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676465 676130 evolution 43064 0.0 S 05:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692336 691540 evolution 43064 0.0 S 03:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693600 693549 evolution 43064 0.0 S 02:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676594 675660 evolution 43056 0.0 S 05:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695347 694912 evolution 43036 0.0 S 00:58 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 687587 676553 evolution 43032 0.0 S 04:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691572 691541 evolution 43032 0.0 S 04:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676568 676458 evolution 43024 0.0 S 05:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693634 678672 evolution 43020 0.0 S 02:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691204 689262 evolution 43012 0.0 S 04:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692207 691535 evolution 43012 0.0 S 03:45 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676982 676554 evolution 43008 0.0 S 04:55 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691001 662371 evolution 43008 0.0 S 04:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691366 691349 evolution 43008 0.0 S 04:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676435 676330 evolution 43004 0.0 S 05:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 686302 676929 evolution 43000 0.0 S 04:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691398 676928 evolution 43000 0.0 S 04:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693633 687743 evolution 42988 0.0 S 02:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695476 694799 evolution 42988 0.0 S 00:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676611 676549 evolution 42984 0.0 S 05:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 683762 657000 evolution 42984 0.0 S 04:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691216 671635 evolution 42984 0.0 S 04:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7017945 | root | 108-1481181613 | Execute | 346 | Sending data | SELECT jobs.id, jobs.pmId, jobs.clientid, jobs.company, jobs.status, jobs.suburb, jobs.new_flag, jobs.reference, jobs.cat, jobs.dateadded, jobs.price, jobs.nextaction, jobs.repId, contacts.code, contacts.company, contacts.lastname, contacts.firstname, contacts.trading_names, jobs.site, jobs | | 7019879 | root | 108-1481181613 | Execute | 321 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019910 | root | 108-1481181613 | Execute | 320 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019901 | root | 108-1481181613 | Execute | 320 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019922 | root | 108-1481181613 | Execute | 318 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020033 | root | 108-1481181613 | Execute | 313 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and dispatch.date > date_sub(dispatch.date, interval 30 day) and jobs.status > 0 order by dispatch.statu | | 7020351 | root | 108-1481181613 | Execute | 304 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020788 | root | 108-1481181613 | Execute | 301 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7024253 | root | 108-1481181613 | Execute | 266 | Waiting for table level lock | SELECT count(timesheets.id) as c FROM timesheets LEFT JOIN jobs ON jobs.id = timesheets.jobid LEFT JOIN invoices ON invoices.id = timesheets.invoiced LEFT JOIN staff ON staff.id = timesheets.approved_by WHERE (1 = 1) AND timesheets.jobid IN (0) AND (timesheets.type = 0) AND opportunityid = '8540 | | 7024261 | root | 108-1481181613 | Execute | 264 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7024690 | root | 108-1481181613 | Execute | 258 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7025229 | root | 108-1481181613 | Execute | 254 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7025856 | root | 108-1481181613 | Execute | 247 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='6' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 7031538 | root | 108-1481181613 | Execute | 184 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts WHERE clientid = jobs.clientid) as company FROM retentions INNER JOIN jobs ON jo | | 7031972 | root | 108-1481181613 | Execute | 178 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 7038985 | root | 108-1481181613 | Execute | 68 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7039907 | root | 108-1481181613 | Execute | 39 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts WHERE clientid = jobs.clientid) as company FROM retentions INNER JOIN jobs ON jo | | 7042107 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7019879 | 108-1481181613 | 321 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019910 | 108-1481181613 | 320 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019901 | 108-1481181613 | 320 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019922 | 108-1481181613 | 318 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7020033 | 108-1481181613 | 313 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and disp | | 7020351 | 108-1481181613 | 304 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7020788 | 108-1481181613 | 301 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7024253 | 108-1481181613 | 266 | Waiting for table level lock | SELECT count(timesheets.id) as c FROM timesheets LEFT JOIN jobs ON jobs.id = timesheets.jobid LEFT JOIN invoices ON invoices.id = timesheets.invoiced LEFT JOIN staff ON staff.id = timesheets.approved_ | | 7024261 | 108-1481181613 | 264 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7024690 | 108-1481181613 | 258 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7025229 | 108-1481181613 | 254 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7025856 | 108-1481181613 | 247 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='6' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 7031538 | 108-1481181613 | 184 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts W | | 7031972 | 108-1481181613 | 178 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 7038985 | 108-1481181613 | 68 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7039907 | 108-1481181613 | 39 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts W | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 429 alison/alisonarts.com.au-ssl_log 115 cosgrovecreative/cosgrovecreative.com.au-ssl_log 68 speedlin/speedlinefencing.com.au-ssl_log 37 madalice/madalice.com.au-ssl_log 36 evolution/portal.evolutionerp.com.au-ssl_log 27 customc/customcentral.com.au-ssl_log 16 aaa/aaadownunder.com.au-ssl_log 14 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 227 103.104.165.99 115 4.204.224.164 73 150.228.243.152 68 52.139.37.240 45 203.54.180.238 43 103.104.164.114 35 195.178.110.102 30 182.239.240.254 29 103.253.27.55 16 52.139.44.162 13 120.150.225.142 9 147.161.213.71 7 147.161.215.103 6 101.166.96.210 3 180.181.236.49 --- top request paths across all vhosts (last 3 min) --- 133 POST /functions.php 67 GET /app/ajax.php 45 POST //functions.php 39 GET /index.php 26 POST /plugins/csvexporter/plugin.php 26 GET /heartbeat.php 14 POST /clienteditsave.php 12 POST /app/ajax/selectFilterSingle.php 12 POST /app/ajax.php 10 POST /wp/ 9 POST //inveditsave.php 8 POST /jobeditsave.php 6 POST /wp/index.php 6 POST /mfreqsave.php 6 POST /logsave.php 6 HEAD /index.php 6 GET //app/ajax.php 4 POST /wp/wp-json/Batch/v1 4 POST /wp//wp-json/batch/v1 4 POST //itemModify.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 133 POST /functions.php 67 GET /app/ajax.php 45 POST //functions.php 39 GET /index.php 26 POST /plugins/csvexporter/plugin.php 14 POST /clienteditsave.php 12 POST /app/ajax/selectFilterSingle.php 12 POST /app/ajax.php 9 POST //inveditsave.php 8 POST /jobeditsave.php 6 POST /mfreqsave.php 6 POST /logsave.php -- last 10 requests -- 150.228.243.152 - - [31/Aug/2026:11:09:49 +1000] "GET /index.php HTTP/1.1" 200 36901 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=58&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 150.228.243.152 - - [31/Aug/2026:11:09:50 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik 150.228.243.152 - - [31/Aug/2026:11:09:51 +1000] "POST /app/ajax.php?call=projectFlagForReview HTTP/1.1" 200 668 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 150.228.243.152 - - [31/Aug/2026:11:09:51 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.164.114 - - [31/Aug/2026:11:09:52 +1000] "GET /index.php?page=login2 HTTP/1.1" 200 36575 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/15 103.104.164.114 - - [31/Aug/2026:11:09:53 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dlogin2&call=getUserSetting&caller=ajaxSubmitLocal&seq=17585758894 HTTP/1.1" 200 86 "https://my.evolutionerp.com.au/index.php?pa 150.228.243.152 - - [31/Aug/2026:11:09:53 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 103.104.164.114 - - [31/Aug/2026:11:09:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.164.114 - - [31/Aug/2026:11:09:53 +1000] "POST /login2save.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=login2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge 103.104.164.114 - - [31/Aug/2026:11:09:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=login2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 GET /admin.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-mails.php 1 GET /wp-includes/Requests/ 1 GET /wp-includes/ID3/about.php 1 GET /wp-includes/blocks/details/ -- last 10 requests -- 4.204.224.164 - - [31/Aug/2026:11:07:51 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:51 +1000] "GET /wp-admin/css/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:51 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:52 +1000] "GET /wp-includes/blocks/details/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:52 +1000] "GET /wp-includes/blocks/audio/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:53 +1000] "GET /wp-temp.php HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:53 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:54 +1000] "GET /wp-includes/Requests/ HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:54 +1000] "GET /wp-content/admin.php HTTP/1.1" 404 5749 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:07:54 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 5749 "-" "-" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /wp-sigunq.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/images/media/ 1 GET /wp-includes/images/crystal/ 1 GET /wp-includes/customize/index.php 1 GET /wp-content/themes/alera/alpha.php 1 GET /wp-content/file.php 1 GET /wp-content/admin.php -- last 10 requests -- 52.139.37.240 - - [31/Aug/2026:11:09:17 +1000] "GET /nf.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:17 +1000] "GET /room.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:17 +1000] "GET /disagreed.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:17 +1000] "GET /kyami.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:17 +1000] "GET /DxHhVcy2bmJ.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:18 +1000] "GET /amaxx.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:18 +1000] "GET /BIBIL0DAY.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:18 +1000] "GET /functions.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:18 +1000] "GET /wp-comments-post.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:18 +1000] "GET /conf_upload.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-31 11:07:34 L1=3.05 run=3 blk=0 avail=5810 (42.2%) swpO=0 conn=18 myRSS=3449 php=91 phpRSS=3915 ap=118 tcp=92 topuser=evolution 2026-08-31 11:07:35 L1=3.05 run=3 blk=0 avail=5781 (42.0%) swpO=0 conn=18 myRSS=3449 php=91 phpRSS=3942 ap=118 tcp=92 topuser=evolution 2026-08-31 11:07:45 L1=3.04 run=4 blk=0 avail=5699 (41.4%) swpO=0 conn=19 myRSS=3451 php=95 phpRSS=4140 ap=118 tcp=98 topuser=evolution 2026-08-31 11:07:45 L1=3.04 run=4 blk=0 avail=5667 (41.1%) swpO=0 conn=17 myRSS=3451 php=95 phpRSS=4168 ap=118 tcp=98 topuser=evolution 2026-08-31 11:07:55 L1=2.95 run=2 blk=0 avail=5786 (42.0%) swpO=606 conn=17 myRSS=3432 php=93 phpRSS=3977 ap=121 tcp=99 topuser=evolution 2026-08-31 11:07:55 L1=2.95 run=5 blk=0 avail=5783 (42.0%) swpO=606 conn=17 myRSS=3432 php=93 phpRSS=3977 ap=121 tcp=94 topuser=evolution 2026-08-31 11:08:05 L1=2.72 run=2 blk=0 avail=5727 (41.6%) swpO=0 conn=18 myRSS=3432 php=95 phpRSS=4077 ap=121 tcp=99 topuser=evolution 2026-08-31 11:08:05 L1=2.72 run=4 blk=0 avail=5713 (41.5%) swpO=0 conn=18 myRSS=3432 php=95 phpRSS=4093 ap=121 tcp=101 topuser=evolution 2026-08-31 11:08:15 L1=2.46 run=2 blk=0 avail=5812 (42.2%) swpO=0 conn=17 myRSS=3432 php=94 phpRSS=4018 ap=115 tcp=89 topuser=evolution 2026-08-31 11:08:15 L1=2.46 run=2 blk=0 avail=5811 (42.2%) swpO=0 conn=17 myRSS=3432 php=94 phpRSS=4018 ap=115 tcp=89 topuser=evolution 2026-08-31 11:08:25 L1=2.31 run=4 blk=0 avail=5659 (41.1%) swpO=139 conn=17 myRSS=3428 php=98 phpRSS=4182 ap=128 tcp=99 topuser=evolution 2026-08-31 11:08:25 L1=2.31 run=3 blk=0 avail=5671 (41.2%) swpO=139 conn=17 myRSS=3428 php=98 phpRSS=4182 ap=128 tcp=99 topuser=evolution 2026-08-31 11:08:35 L1=2.18 run=6 blk=0 avail=5483 (39.8%) swpO=0 conn=19 myRSS=3428 php=105 phpRSS=4614 ap=122 tcp=102 topuser=evolution 2026-08-31 11:08:35 L1=2.18 run=11 blk=0 avail=5450 (39.6%) swpO=0 conn=19 myRSS=3428 php=106 phpRSS=4693 ap=122 tcp=103 topuser=evolution 2026-08-31 11:08:45 L1=2.53 run=4 blk=0 avail=5316 (38.6%) swpO=44 conn=18 myRSS=3426 php=104 phpRSS=4586 ap=147 tcp=96 topuser=evolution 2026-08-31 11:08:45 L1=2.53 run=6 blk=0 avail=5290 (38.4%) swpO=44 conn=18 myRSS=3426 php=104 phpRSS=4613 ap=147 tcp=96 topuser=evolution 2026-08-31 11:08:55 L1=2.45 run=7 blk=0 avail=5269 (38.2%) swpO=0 conn=18 myRSS=3426 php=110 phpRSS=4793 ap=137 tcp=101 topuser=evolution 2026-08-31 11:08:55 L1=2.45 run=4 blk=0 avail=5266 (38.2%) swpO=0 conn=18 myRSS=3426 php=110 phpRSS=4793 ap=137 tcp=101 topuser=evolution 2026-08-31 11:09:05 L1=2.30 run=4 blk=0 avail=5158 (37.4%) swpO=721 conn=19 myRSS=3408 php=115 phpRSS=4997 ap=130 tcp=105 topuser=evolution 2026-08-31 11:09:06 L1=2.30 run=2 blk=0 avail=5302 (38.5%) swpO=655 conn=19 myRSS=3408 php=115 phpRSS=4997 ap=131 tcp=103 topuser=evolution 2026-08-31 11:09:16 L1=2.10 run=4 blk=0 avail=5294 (38.4%) swpO=0 conn=19 myRSS=3408 php=116 phpRSS=5037 ap=134 tcp=97 topuser=evolution 2026-08-31 11:09:16 L1=2.10 run=2 blk=0 avail=5292 (38.4%) swpO=0 conn=19 myRSS=3408 php=116 phpRSS=5037 ap=134 tcp=97 topuser=evolution 2026-08-31 11:09:26 L1=2.09 run=4 blk=0 avail=5216 (37.9%) swpO=0 conn=19 myRSS=3407 php=118 phpRSS=5145 ap=135 tcp=105 topuser=evolution 2026-08-31 11:09:26 L1=2.09 run=2 blk=0 avail=5192 (37.7%) swpO=0 conn=20 myRSS=3407 php=119 phpRSS=5184 ap=137 tcp=106 topuser=evolution 2026-08-31 11:09:36 L1=2.16 run=5 blk=0 avail=5235 (38.0%) swpO=0 conn=22 myRSS=3407 php=125 phpRSS=5225 ap=149 tcp=112 topuser=evolution 2026-08-31 11:09:36 L1=2.16 run=8 blk=0 avail=5184 (37.6%) swpO=0 conn=22 myRSS=3407 php=125 phpRSS=5223 ap=153 tcp=117 topuser=evolution 2026-08-31 11:09:46 L1=2.06 run=4 blk=1 avail=5038 (36.6%) swpO=287 conn=21 myRSS=3399 php=120 phpRSS=5292 ap=152 tcp=100 topuser=evolution 2026-08-31 11:09:46 L1=2.06 run=4 blk=0 avail=5111 (37.1%) swpO=287 conn=20 myRSS=3399 php=121 phpRSS=5244 ap=151 tcp=100 topuser=evolution 2026-08-31 11:09:56 L1=1.90 run=2 blk=0 avail=5157 (37.4%) swpO=0 conn=20 myRSS=3399 php=121 phpRSS=5239 ap=144 tcp=104 topuser=evolution 2026-08-31 11:09:56 L1=1.90 run=4 blk=0 avail=5156 (37.4%) swpO=0 conn=20 myRSS=3399 php=121 phpRSS=5239 ap=144 tcp=104 topuser=evolution