INCIDENT 2026-08-31 11:10:57 trigger: php_procs=129 php_rss=5457MB mysql_conn=20 ================================================================== load: 2.09 2.47 2.66 5/896 710562 ncpu:10 mem_avail: 5184MB/13777MB (37.6%) swap_used:2084MB swapout:0/s blocked(D):0 running:3 iowait:0.1% steal:0.0% php: 129 procs / 5457MB heaviest user: evolution (127 procs, 5289MB) apache: 153 procs tcp_estab: 102 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 131 5296 mysql 1 3399 nobody 152 2676 root 248 921 netdata 7 204 customc 1 152 mailman 20 75 dovenull 6 46 mailnull 2 27 wp-toolkit 3 21 zabbix 1 19 dovecot 3 18 alison 1 15 candyfabcom 1 14 kurri 1 12 named 1 11 sshd 1 4 nscd 1 4 polkitd 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 127 5289 customc 1 154 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4049 MB Active(file): 2437 MB Inactive(file): 1398 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 507 MB CommitLimit: 10984 MB Committed_AS: 27157 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-08:52:18 4400 /usr/bin/imunify-agent-proxy 656623 root 10:56 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3480788 8.0 Ssl 3-08:51:47 /usr/sbin/mariadbd 3036527 3002570 root 201004 0.1 S 08:39:15 spamd child 508924 1 netdata 185016 1.9 Ssl 3-08:51:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 710529 700175 customc 160560 61.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3002570 1 root 147112 0.0 Ss 08:48:11 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 137328 0.0 S 08:39:15 spamd child 695548 694740 evolution 68796 0.1 S 01:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676464 676124 evolution 68640 0.0 S 06:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692761 691537 evolution 68604 0.0 S 04:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676428 676123 evolution 67764 0.0 S 06:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676152 676132 evolution 67064 0.0 S 06:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 62932 0.0 Sl 3-08:51:11 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509266 1 root 57912 0.0 Ss 3-08:51:13 /usr/lib/systemd/systemd-journald 710415 694567 evolution 44044 0.2 S 00:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691218 690603 evolution 43212 0.0 S 05:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694997 693466 evolution 43176 0.0 S 02:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676447 674419 evolution 43152 0.0 S 06:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692343 691002 evolution 43152 0.0 S 04:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691050 689265 evolution 43148 0.0 S 05:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691451 691273 evolution 43140 0.0 S 05:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676437 676122 evolution 43136 0.0 S 06:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676577 676131 evolution 43136 0.0 S 06:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692756 676555 evolution 43136 0.0 S 04:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695696 695671 evolution 43120 0.0 S 01:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691340 691335 evolution 43116 0.0 S 05:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694453 691536 evolution 43112 0.0 S 02:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695348 694911 evolution 43108 0.0 S 01:59 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692434 691510 evolution 43104 0.0 S 04:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676939 676548 evolution 43096 0.0 S 06:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693653 692494 evolution 43092 0.0 S 03:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694540 676442 evolution 43088 0.0 S 02:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691032 676112 evolution 43080 0.0 S 05:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 694652 693095 evolution 43080 0.0 S 02:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676440 673161 evolution 43076 0.0 S 06:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676925 676542 evolution 43076 0.0 S 06:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695022 694889 evolution 43076 0.0 S 02:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695396 694561 evolution 43068 0.0 S 01:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676465 676130 evolution 43064 0.0 S 06:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692336 691540 evolution 43064 0.0 S 04:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693600 693549 evolution 43064 0.0 S 03:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676594 675660 evolution 43056 0.0 S 06:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695347 694912 evolution 43036 0.0 S 01:59 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 687587 676553 evolution 43032 0.0 S 05:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691572 691541 evolution 43032 0.0 S 05:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676568 676458 evolution 43024 0.0 S 06:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693634 678672 evolution 43020 0.0 S 03:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691204 689262 evolution 43012 0.0 S 05:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 692207 691535 evolution 43012 0.0 S 04:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 710303 695692 evolution 43012 0.1 S 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676982 676554 evolution 43008 0.0 S 05:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691001 662371 evolution 43008 0.0 S 05:42 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691366 691349 evolution 43008 0.0 S 05:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676435 676330 evolution 43004 0.0 S 06:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 686302 676929 evolution 43000 0.0 S 05:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 691398 676928 evolution 43000 0.0 S 05:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 710279 692495 evolution 43000 0.1 S 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 693633 687743 evolution 42988 0.0 S 03:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 695476 694799 evolution 42988 0.0 S 01:45 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676611 676549 evolution 42984 0.0 S 06:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 683762 657000 evolution 42984 0.0 S 05:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7017945 | root | 108-1481181613 | Execute | 406 | Sending data | SELECT jobs.id, jobs.pmId, jobs.clientid, jobs.company, jobs.status, jobs.suburb, jobs.new_flag, jobs.reference, jobs.cat, jobs.dateadded, jobs.price, jobs.nextaction, jobs.repId, contacts.code, contacts.company, contacts.lastname, contacts.firstname, contacts.trading_names, jobs.site, jobs | | 7019879 | root | 108-1481181613 | Execute | 382 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019901 | root | 108-1481181613 | Execute | 381 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019910 | root | 108-1481181613 | Execute | 380 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019922 | root | 108-1481181613 | Execute | 379 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020033 | root | 108-1481181613 | Execute | 374 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and dispatch.date > date_sub(dispatch.date, interval 30 day) and jobs.status > 0 order by dispatch.statu | | 7020351 | root | 108-1481181613 | Execute | 365 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020788 | root | 108-1481181613 | Execute | 362 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7024253 | root | 108-1481181613 | Execute | 327 | Waiting for table level lock | SELECT count(timesheets.id) as c FROM timesheets LEFT JOIN jobs ON jobs.id = timesheets.jobid LEFT JOIN invoices ON invoices.id = timesheets.invoiced LEFT JOIN staff ON staff.id = timesheets.approved_by WHERE (1 = 1) AND timesheets.jobid IN (0) AND (timesheets.type = 0) AND opportunityid = '8540 | | 7024261 | root | 108-1481181613 | Execute | 325 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7024690 | root | 108-1481181613 | Execute | 319 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7025229 | root | 108-1481181613 | Execute | 314 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7025856 | root | 108-1481181613 | Execute | 308 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='6' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 7031538 | root | 108-1481181613 | Execute | 244 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts WHERE clientid = jobs.clientid) as company FROM retentions INNER JOIN jobs ON jo | | 7031972 | root | 108-1481181613 | Execute | 239 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 7038985 | root | 108-1481181613 | Execute | 129 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7039907 | root | 108-1481181613 | Execute | 100 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts WHERE clientid = jobs.clientid) as company FROM retentions INNER JOIN jobs ON jo | | 7045011 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7019879 | 108-1481181613 | 382 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019901 | 108-1481181613 | 381 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019910 | 108-1481181613 | 380 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019922 | 108-1481181613 | 379 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7020033 | 108-1481181613 | 374 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and disp | | 7020351 | 108-1481181613 | 365 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7020788 | 108-1481181613 | 362 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7024253 | 108-1481181613 | 327 | Waiting for table level lock | SELECT count(timesheets.id) as c FROM timesheets LEFT JOIN jobs ON jobs.id = timesheets.jobid LEFT JOIN invoices ON invoices.id = timesheets.invoiced LEFT JOIN staff ON staff.id = timesheets.approved_ | | 7024261 | 108-1481181613 | 325 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7024690 | 108-1481181613 | 319 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7025229 | 108-1481181613 | 314 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7025856 | 108-1481181613 | 308 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='6' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 7031538 | 108-1481181613 | 244 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts W | | 7031972 | 108-1481181613 | 239 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 7038985 | 108-1481181613 | 129 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7039907 | 108-1481181613 | 100 | Waiting for table level lock | SELECT jobs.id as id, jobcode, rid, rdate, ramount, rstatus, (SELECT IF(TRIM(company) <> '', TRIM(company), CONCAT(TRIM(firstname), ' ', TRIM(lastname))) FROM contacts W | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 389 cosgrovecreative/cosgrovecreative.com.au-ssl_log 77 madalice/madalice.com.au-ssl_log 41 lowrange/lowrange.com.au-ssl_log 38 evolution/portal.evolutionerp.com.au-ssl_log 25 alison/alisonarts.com.au-ssl_log 15 speedlin/speedlinefencing.com.au-ssl_log 14 aaa/aaadownunder.com.au-ssl_log 11 speedlin/speedlinefencing.com.au 11 olympic/olympicfencing.com.au-ssl_log 7 corpkicks/corporatekicks.com.au-ssl_log 4 olympic/olympicfencing.com.au 4 evolution/evolutionerp.com.au-ssl_log 3 kurri/kurrimotorinn.com.au 3 customc/customcentral.com.au-ssl_log 2 (total vhosts taking traffic: 17) --- top client IPs across all vhosts (last 3 min) --- 164 103.104.165.99 115 52.139.37.240 71 150.228.243.152 63 103.104.164.114 51 101.166.96.210 41 203.54.180.238 29 103.253.27.55 21 93.123.109.164 15 4.204.224.164 10 16.144.229.252 9 147.161.213.71 7 182.239.240.254 6 45.148.10.40 6 118.127.40.55 5 147.161.215.103 --- top request paths across all vhosts (last 3 min) --- 119 POST /functions.php 71 GET /app/ajax.php 36 POST //functions.php 36 GET /index.php 25 POST /plugins/csvexporter/plugin.php 25 GET /heartbeat.php 19 GET / 10 POST /app/ajax/selectFilterSingle.php 10 POST /app/ajax.php 9 POST /quoteditsave.php 8 POST //inveditsave.php 8 POST / 7 POST /plugins/fencecosting/plugin.php 7 POST /jobeditsave.php 6 POST /clienteditsave.php 5 POST /wp-cron.php 5 HEAD /index.php 5 GET //app/ajax.php 4 POST //itemModify.php 4 GET /terms-and- --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 119 POST /functions.php 71 GET /app/ajax.php 36 POST //functions.php 34 GET /index.php 25 POST /plugins/csvexporter/plugin.php 10 POST /app/ajax/selectFilterSingle.php 10 POST /app/ajax.php 9 POST /quoteditsave.php 8 POST //inveditsave.php 7 POST /plugins/fencecosting/plugin.php 7 POST /jobeditsave.php 6 POST /clienteditsave.php -- last 10 requests -- 103.104.165.99 - - [31/Aug/2026:11:10:49 +1000] "POST //clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=12061&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; 103.104.165.99 - - [31/Aug/2026:11:10:50 +1000] "POST //plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=12061&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; W 103.104.165.99 - - [31/Aug/2026:11:10:49 +1000] "POST //logsave.php?call=getHistory&id=12061&module=job HTTP/1.1" 200 652 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=12061&tab=generaltab" "Mozilla/5.0 (Win 103.104.165.99 - - [31/Aug/2026:11:10:50 +1000] "GET //app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=17553234851 HTTP/1.1" 200 215 "https://my.evolutionerp.com.au//index.php?page=jobedit& 103.104.165.99 - - [31/Aug/2026:11:10:50 +1000] "GET //app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13516200063 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au//ind 103.104.165.99 - - [31/Aug/2026:11:10:50 +1000] "GET //app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D12061%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=14033789569 HTTP/1.1" 103.104.165.99 - - [31/Aug/2026:11:10:50 +1000] "GET //app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D12061%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=13376158696 HTTP/1.1" 200 112 "https://m 103.104.165.99 - - [31/Aug/2026:11:10:50 +1000] "GET //app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=12315403086 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au//in 103.104.164.114 - - [31/Aug/2026:11:10:50 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=staffedit&id=11" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.164.114 - - [31/Aug/2026:11:10:51 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 4901 "https://my.evolutionerp.com.au/index.php?page=staffedit&id=11" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /zoom1.php 1 GET /y.php 1 GET /yanz.php 1 GET /xleet.php 1 GET /wp-sigunq.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/images/media/ 1 GET /wp-includes/images/crystal/ 1 GET /wp-includes/customize/index.php 1 GET /wp-content/themes/alera/alpha.php -- last 10 requests -- 52.139.37.240 - - [31/Aug/2026:11:09:18 +1000] "GET /conf_upload.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:19 +1000] "GET /content.php888 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:19 +1000] "GET /gecko-new.php.1 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:19 +1000] "GET /OthioNDwMEK.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:19 +1000] "GET /sim.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /y.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /xleet.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /admin.php1 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /M1.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /ds.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/custom-richmond-tigers-kids/ 3 GET // 3 GET / 2 GET //xmlrpc.php 2 GET //wp-includes/wlwmanifest.xml 2 GET /store/custom-rainbow-swoosh-sneakers-copy/ 1 POST //xmlrpc.php 1 POST //wp-login.php 1 GET //wp/wp-includes/wlwmanifest.xml 1 GET //wp-login.php 1 GET //wp-json/wp/v2/users/ 1 GET //wp-json/oembed/1.0/embed -- last 10 requests -- 103.253.27.55 - - [31/Aug/2026:11:08:50 +1000] "POST //wp-login.php HTTP/1.1" 503 6742 "https://madalice.com.au//wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0 2a03:2880:f802:30:: - - [31/Aug/2026:11:09:07 +1000] "GET /tag/leaf/ HTTP/1.1" 200 35396 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compati 114.119.131.88 - - [31/Aug/2026:11:09:09 +1000] "GET /store/custom-richmond-tigers-kids/?rating=2&image=1&wcpr_rating=3&wcpr_verified=1 HTTP/1.1" 404 36675 "https://madalice.com.au/store/custom-richmond-tigers-kids/?rati 34.225.87.80 - - [31/Aug/2026:11:09:34 +1000] "GET /wp-content/plugins/woo-custom-product-addons-pro/includes/s3.php HTTP/1.1" 200 1 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +htt 193.25.127.212 - - [31/Aug/2026:11:09:36 +1000] "GET / HTTP/1.1" 200 42732 "http://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.3" 194.14.75.111 - - [31/Aug/2026:11:09:39 +1000] "GET /product-category/accessories/sneaker-storage/ HTTP/1.1" 200 36153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0. 185.13.98.176 - - [31/Aug/2026:11:09:42 +1000] "GET /store/xl-magnetic-drop-down-side-door-sneaker-display-case-black/ HTTP/1.1" 200 51105 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge 114.119.143.14 - - [31/Aug/2026:11:09:42 +1000] "GET /store/custom-rainbow-swoosh-sneakers-copy/?rating=3&image=1&wcpr_rating=1&wcpr_verified=1 HTTP/1.1" 404 36673 "https://madalice.com.au/store/custom-rainbow-swoosh-sne 185.139.153.232 - - [31/Aug/2026:11:09:45 +1000] "GET /store/mad-alice-custom-shoe-magnetic-drop-side-display-cases/ HTTP/1.1" 200 52666 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck 114.119.143.104 - - [31/Aug/2026:11:10:03 +1000] "GET /store/custom-rainbow-swoosh-sneakers-copy/?amprating=5&wcpr_rating=3&wcpr_page=4 HTTP/1.1" 404 36670 "https://madalice.com.au/store/custom-rainbow-swoosh-sneakers-co --- last 30 samples (run-up to this incident) --- 2026-08-31 11:08:35 L1=2.18 run=6 blk=0 avail=5483 (39.8%) swpO=0 conn=19 myRSS=3428 php=105 phpRSS=4614 ap=122 tcp=102 topuser=evolution 2026-08-31 11:08:35 L1=2.18 run=11 blk=0 avail=5450 (39.6%) swpO=0 conn=19 myRSS=3428 php=106 phpRSS=4693 ap=122 tcp=103 topuser=evolution 2026-08-31 11:08:45 L1=2.53 run=4 blk=0 avail=5316 (38.6%) swpO=44 conn=18 myRSS=3426 php=104 phpRSS=4586 ap=147 tcp=96 topuser=evolution 2026-08-31 11:08:45 L1=2.53 run=6 blk=0 avail=5290 (38.4%) swpO=44 conn=18 myRSS=3426 php=104 phpRSS=4613 ap=147 tcp=96 topuser=evolution 2026-08-31 11:08:55 L1=2.45 run=7 blk=0 avail=5269 (38.2%) swpO=0 conn=18 myRSS=3426 php=110 phpRSS=4793 ap=137 tcp=101 topuser=evolution 2026-08-31 11:08:55 L1=2.45 run=4 blk=0 avail=5266 (38.2%) swpO=0 conn=18 myRSS=3426 php=110 phpRSS=4793 ap=137 tcp=101 topuser=evolution 2026-08-31 11:09:05 L1=2.30 run=4 blk=0 avail=5158 (37.4%) swpO=721 conn=19 myRSS=3408 php=115 phpRSS=4997 ap=130 tcp=105 topuser=evolution 2026-08-31 11:09:06 L1=2.30 run=2 blk=0 avail=5302 (38.5%) swpO=655 conn=19 myRSS=3408 php=115 phpRSS=4997 ap=131 tcp=103 topuser=evolution 2026-08-31 11:09:16 L1=2.10 run=4 blk=0 avail=5294 (38.4%) swpO=0 conn=19 myRSS=3408 php=116 phpRSS=5037 ap=134 tcp=97 topuser=evolution 2026-08-31 11:09:16 L1=2.10 run=2 blk=0 avail=5292 (38.4%) swpO=0 conn=19 myRSS=3408 php=116 phpRSS=5037 ap=134 tcp=97 topuser=evolution 2026-08-31 11:09:26 L1=2.09 run=4 blk=0 avail=5216 (37.9%) swpO=0 conn=19 myRSS=3407 php=118 phpRSS=5145 ap=135 tcp=105 topuser=evolution 2026-08-31 11:09:26 L1=2.09 run=2 blk=0 avail=5192 (37.7%) swpO=0 conn=20 myRSS=3407 php=119 phpRSS=5184 ap=137 tcp=106 topuser=evolution 2026-08-31 11:09:36 L1=2.16 run=5 blk=0 avail=5235 (38.0%) swpO=0 conn=22 myRSS=3407 php=125 phpRSS=5225 ap=149 tcp=112 topuser=evolution 2026-08-31 11:09:36 L1=2.16 run=8 blk=0 avail=5184 (37.6%) swpO=0 conn=22 myRSS=3407 php=125 phpRSS=5223 ap=153 tcp=117 topuser=evolution 2026-08-31 11:09:46 L1=2.06 run=4 blk=1 avail=5038 (36.6%) swpO=287 conn=21 myRSS=3399 php=120 phpRSS=5292 ap=152 tcp=100 topuser=evolution 2026-08-31 11:09:46 L1=2.06 run=4 blk=0 avail=5111 (37.1%) swpO=287 conn=20 myRSS=3399 php=121 phpRSS=5244 ap=151 tcp=100 topuser=evolution 2026-08-31 11:09:56 L1=1.90 run=2 blk=0 avail=5157 (37.4%) swpO=0 conn=20 myRSS=3399 php=121 phpRSS=5239 ap=144 tcp=104 topuser=evolution 2026-08-31 11:09:56 L1=1.90 run=4 blk=0 avail=5156 (37.4%) swpO=0 conn=20 myRSS=3399 php=121 phpRSS=5239 ap=144 tcp=104 topuser=evolution 2026-08-31 11:10:06 L1=2.16 run=5 blk=1 avail=4955 (36.0%) swpO=0 conn=21 myRSS=3398 php=125 phpRSS=5460 ap=147 tcp=107 topuser=evolution 2026-08-31 11:10:06 L1=2.16 run=6 blk=1 avail=4948 (35.9%) swpO=0 conn=21 myRSS=3398 php=125 phpRSS=5462 ap=147 tcp=107 topuser=evolution 2026-08-31 11:10:16 L1=2.36 run=5 blk=0 avail=5058 (36.7%) swpO=0 conn=24 myRSS=3398 php=127 phpRSS=5532 ap=143 tcp=100 topuser=evolution 2026-08-31 11:10:16 L1=2.36 run=7 blk=0 avail=5051 (36.7%) swpO=0 conn=24 myRSS=3398 php=127 phpRSS=5539 ap=143 tcp=100 topuser=evolution 2026-08-31 11:10:26 L1=2.38 run=3 blk=0 avail=5262 (38.2%) swpO=0 conn=21 myRSS=3398 php=125 phpRSS=5231 ap=150 tcp=99 topuser=evolution 2026-08-31 11:10:26 L1=2.38 run=6 blk=0 avail=5252 (38.1%) swpO=0 conn=22 myRSS=3398 php=126 phpRSS=5276 ap=150 tcp=99 topuser=evolution 2026-08-31 11:10:36 L1=2.25 run=4 blk=0 avail=5186 (37.6%) swpO=0 conn=20 myRSS=3398 php=128 phpRSS=5383 ap=144 tcp=102 topuser=evolution 2026-08-31 11:10:37 L1=2.25 run=5 blk=0 avail=5186 (37.6%) swpO=0 conn=19 myRSS=3398 php=127 phpRSS=5376 ap=144 tcp=102 topuser=evolution 2026-08-31 11:10:47 L1=2.20 run=3 blk=0 avail=5111 (37.1%) swpO=0 conn=20 myRSS=3399 php=130 phpRSS=5579 ap=148 tcp=101 topuser=evolution 2026-08-31 11:10:47 L1=2.20 run=3 blk=0 avail=5114 (37.1%) swpO=0 conn=19 myRSS=3399 php=130 phpRSS=5584 ap=148 tcp=101 topuser=evolution 2026-08-31 11:10:57 L1=2.09 run=3 blk=0 avail=5184 (37.6%) swpO=0 conn=20 myRSS=3399 php=129 phpRSS=5457 ap=153 tcp=102 topuser=evolution 2026-08-31 11:10:57 L1=2.09 run=5 blk=0 avail=5174 (37.6%) swpO=0 conn=20 myRSS=3399 php=129 phpRSS=5465 ap=153 tcp=102 topuser=evolution