INCIDENT 2026-09-06 10:28:52 trigger: php_rss=1843MB ================================================================== load: 2.84 1.92 1.69 27/675 1830720 ncpu:10 mem_avail: 8661MB/13777MB (62.9%) swap_used:2079MB swapout:539/s blocked(D):1 running:13 iowait:4.5% steal:0.0% php: 20 procs / 1843MB heaviest user: evolution (19 procs, 1819MB) apache: 43 procs tcp_estab: 55 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 34 1976 mysql 1 1079 root 256 917 nobody 42 620 netdata 8 248 mailman 20 190 wp-toolkit 3 63 dovenull 6 55 cpanellogin 1 47 aaa 3 47 mailnull 3 46 named 1 27 madalice 1 25 kurri 2 24 dovecot 3 23 polkitd 1 13 zabbix 1 10 rpc 1 4 nscd 1 4 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB evolution 29 2075 madalice 1 32 root 1 24 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6896 MB Active(file): 3756 MB Inactive(file): 3286 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 565 MB CommitLimit: 10984 MB Committed_AS: 9627 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 5-08:06:27 5936 /usr/bin/imunify-agent-proxy 4109079 root 1-05:44:05 1776 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-05:44:05 63904 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1105476 2.9 Ssl 14:52:22 /usr/sbin/mariadbd 166870 1 netdata 184320 2.6 Ssl 08:06:33 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1830665 1830621 evolution 181276 50.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830666 1829330 evolution 179352 51.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 220206 168913 root 178812 0.0 S 07:50:35 spamd child 1830669 1830608 evolution 171688 38.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830670 1830591 evolution 164888 83.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 167871 1 root 132292 0.0 Ss 08:06:26 /usr/lib/systemd/systemd-journald 1830673 1829346 evolution 117900 41.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830672 1830620 evolution 117840 40.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 168913 1 root 96076 0.0 Ss 08:05:23 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1830689 1829345 evolution 93056 29.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830685 1830618 evolution 83332 25.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830690 1830616 evolution 83288 23.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 220207 168913 root 82876 0.0 S 07:50:35 spamd child 1830704 1830619 evolution 74916 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830687 1829307 evolution 71936 17.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830691 1830642 evolution 71728 16.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830710 1830644 evolution 69452 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830716 1830652 evolution 66040 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4109105 4109079 root 63904 1.8 Sl 1-05:44:05 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1830717 1830656 evolution 62540 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830709 1830645 evolution 62472 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830707 1830649 evolution 62404 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830712 1830654 evolution 61220 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830708 1830648 evolution 61212 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830667 1830587 evolution 56836 44.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760293 1353308 cpanellogin 48636 0.0 S 23:30 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 1830714 1830655 evolution 47448 0.0 S 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830713 1830650 evolution 45116 0.0 S 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1353308 1 root 42464 0.1 Ss 46-07:47:39 cpsrvd (SSL) - waiting for connections 1830711 1830643 evolution 42256 0.0 S 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1830715 1830657 evolution 42196 0.0 S 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1469 1 root 42124 0.1 Ss 69-00:19:08 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1830703 167896 madalice 41396 0.0 R 00:00 php-fpm: pool madalice_com_au 167562 166914 netdata 38792 0.1 Sl 08:06:28 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 34716 0.0 Ss 08:06:37 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 34400 0.0 Sl 9-08:09:13 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166809 1 named 27764 0.0 Ssl 08:06:35 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1463 1 root 24600 0.0 Ss 69-00:19:08 tailwatchd 167896 1 root 24596 0.0 Ss 08:06:25 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 167845 1 wp-toolkit 24232 0.0 Ss 08:06:26 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1829330 506832 nobody 20272 0.0 S 01:56 /usr/sbin/httpd -k start 1829346 506832 nobody 19648 0.0 S 01:55 /usr/sbin/httpd -k start 1829352 506832 nobody 19556 0.0 S 01:55 /usr/sbin/httpd -k start 1829307 506832 nobody 19504 0.1 S 01:58 /usr/sbin/httpd -k start 1829136 167382 aaa 19368 1.0 S 02:14 dovecot/imap 1829328 506832 nobody 18832 0.0 S 01:56 /usr/sbin/httpd -k start 167814 1 root 18736 0.0 Ss 08:06:26 lfd - sleeping 508720 1 mailnull 18284 0.0 Ss 9-08:09:20 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 167566 166914 netdata 17544 2.1 Sl 08:06:28 /usr/libexec/netdata/plugins.d/apps.plugin 1 1829341 506832 nobody 17120 0.0 S 01:55 /usr/sbin/httpd -k start 167017 1 root 17044 0.1 Ssl 08:06:32 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1829345 506832 nobody 16576 0.1 S 01:55 /usr/sbin/httpd -k start 1829338 506832 nobody 16464 0.0 S 01:55 /usr/sbin/httpd -k start 1830587 506832 nobody 16348 0.1 S 00:07 /usr/sbin/httpd -k start 1830607 506832 nobody 16336 0.2 S 00:05 /usr/sbin/httpd -k start 1830618 506832 nobody 16328 0.2 S 00:04 /usr/sbin/httpd -k start 1830592 506832 nobody 16312 0.1 S 00:06 /usr/sbin/httpd -k start 1829347 506832 nobody 16276 0.0 S 01:55 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+--------------------+--------------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+--------------------+--------------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 412698 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 412697 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | | 412696 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | | 412690 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Writing to net | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | | 412685 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 412683 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 412681 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'ninja_forms_oauth_client_id' LIMIT 1 | | 412680 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | | 412678 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'ninja_forms_oauth_client_id' LIMIT 1 | | 412677 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'reader_chat' LIMIT 1 | | 412676 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'reader_chat' LIMIT 1 | | 412675 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_boost_ds_render_blocking_js_excludes' LIMIT 1 | | 412674 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_boost_ds_minify_css_excludes' LIMIT 1 | | 412672 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | UPDATE `QpCIPREUS_options` SET `option_value` = 'a:2:{s:6:\"expire\";i:1791246533;s:4:\"data\";a:3:{s:5:\"paths\";a:4:{i:0;s:87:\"/wp-content/plugins/astra-sites/inc/lib/onboarding/assets/dist/template-preview/main.js\";i:1;s:41:\"/wp-content/themes/Divi/js/scripts.min.js\";i:2;s:91:\"/wp-content/th | +--------+--------------------+--------------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +--------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +--------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 412697 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | | 412696 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | | 412685 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 412684 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 412683 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 412681 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'ninja_forms_oauth_client_id' LIMIT 1 | | 412680 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | | 412678 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'ninja_forms_oauth_client_id' LIMIT 1 | | 412677 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'reader_chat' LIMIT 1 | | 412676 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'reader_chat' LIMIT 1 | | 412675 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_boost_ds_render_blocking_js_excludes' LIMIT 1 | | 412674 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_boost_ds_minify_css_excludes' LIMIT 1 | | 412672 | evolution_wp_nv3qp | 0 | Waiting for table level lock | UPDATE `QpCIPREUS_options` SET `option_value` = 'a:2:{s:6:\"expire\";i:1791246533;s:4:\"data\";a:3:{s:5:\"paths\";a:4:{i:0;s:87:\"/wp-content/plugins/astra-sites/inc/lib/onboarding/assets/dist/templat | +--------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 134 olympic/olympicfencing.com.au-ssl_log 47 evolution/evolutionerp.com.au-ssl_log 41 vinesit/vinesit.com.au-ssl_log 25 olympic/olympicfencing.com.au 23 corpkicks/corporatekicks.com.au-ssl_log 11 vinesit/vinesit.com.au 10 madalice/madalice.com.au-ssl_log 9 evolution/my.evolutionerp.com.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 5 infinium/infinium.net.au-ssl_log 5 tubesupplies/tubesupplies.com.au-ssl_log 5 alison/alisonarts.com.au-ssl_log 4 corpkicks/2025.corporatekicks.com.au-ssl_log 2 kurri/kurrimotorinn.com.au-ssl_log 2 (total vhosts taking traffic: 23) --- top client IPs across all vhosts (last 3 min) --- 134 40.115.94.245 64 4.204.224.164 38 34.65.21.34 36 35.241.89.166 11 118.127.40.55 8 34.207.86.197 3 43.130.67.6 2 91.92.243.248 2 69.49.241.76 2 66.116.251.167 2 52.167.144.210 2 50.6.207.27 2 47.82.11.3 2 43.164.3.182 2 216.73.217.50 --- top request paths across all vhosts (last 3 min) --- 103 GET /api/getItem/LWPB2001KG 13 GET /api/getItem/LWHG2001KG 11 GET / 10 POST /wp-cron.php 8 POST /wp-login.php 8 GET /robots.txt 5 POST / 5 GET /wp-login.php 5 GET /store/black-nike-air-forces-drippy-custom-shoes/ 3 POST /functions.php 3 GET /w.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /wp_blog_footer.php 3 GET /vpn.php 3 GET /this_is_a_new_hello_world.php 3 GET /sss.php 3 GET /run.php 3 GET /robot.php 3 GET /or.php 3 GET /f35.update.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 103 GET /api/getItem/LWPB2001KG 13 GET /api/getItem/LWHG2001KG 2 GET /api/getItem/PXLG20 1 GET /api/getItem/PXLG50 1 GET /api/getItem/PXLG40 1 GET /api/getItem/PXLG32 1 GET /api/getItem/PXLG25 1 GET /api/getItem/PMG80 1 GET /api/getItem/PMG65 1 GET /api/getItem/PMG50 1 GET /api/getItem/PMG40 1 GET /api/getItem/PMG32 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:10:28:27 +1000] "GET /api/getItem/PMG32 HTTP/1.1" 200 2411 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:10:28:27 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:10:28:28 +1000] "GET /api/getItem/PMG40 HTTP/1.1" 200 2432 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:10:28:28 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:10:28:28 +1000] "GET /api/getItem/PMG50 HTTP/1.1" 200 2203 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:10:28:28 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:10:28:28 +1000] "GET /api/getItem/PMG65 HTTP/1.1" 200 1868 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:10:28:28 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:10:28:29 +1000] "GET /api/getItem/PMG80 HTTP/1.1" 200 2200 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:10:28:29 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 3 POST /wp-cron.php 2 GET /w.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp_blog_footer.php 2 GET /vpn.php 2 GET /this_is_a_new_hello_world.php 2 GET /sss.php 2 GET /run.php 2 GET /robot.php 2 GET /or.php 2 GET /f35.update.php 2 GET /dex.php -- last 10 requests -- 4.204.224.164 - - [06/Sep/2026:10:27:50 +1000] "GET /wp_blog_footer.php HTTP/1.1" 301 - "-" "-" 4.204.224.164 - - [06/Sep/2026:10:27:51 +1000] "GET /wp_blog_footer.php HTTP/1.1" 404 56918 "-" "-" 4.204.224.164 - - [06/Sep/2026:10:27:53 +1000] "GET /robot.php HTTP/1.1" 301 - "-" "-" 4.204.224.164 - - [06/Sep/2026:10:27:54 +1000] "GET /robot.php HTTP/1.1" 404 56918 "-" "-" 4.204.224.164 - - [06/Sep/2026:10:27:57 +1000] "GET /sss.php?p= HTTP/1.1" 301 - "-" "-" 4.204.224.164 - - [06/Sep/2026:10:27:58 +1000] "GET /sss.php HTTP/1.1" 404 56918 "-" "-" 4.204.224.164 - - [06/Sep/2026:10:28:00 +1000] "GET /or.php HTTP/1.1" 301 - "-" "-" 4.204.224.164 - - [06/Sep/2026:10:28:01 +1000] "GET /or.php HTTP/1.1" 404 56918 "-" "-" 4.204.224.164 - - [06/Sep/2026:10:28:03 +1000] "GET /b8.php HTTP/1.1" 301 - "-" "-" 4.204.224.164 - - [06/Sep/2026:10:28:05 +1000] "GET /b8.php HTTP/1.1" 404 56918 "-" "-" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 GET /.zprofile 1 GET /www.zip 1 GET /sql.gz 1 GET /secrets.yaml 1 GET /.python_history 1 GET /public_html.zip 1 GET /.psql_history 1 GET /.profile 1 GET /phpinfo.php 1 GET /.node_repl_history 1 GET /mysql.sql -- last 10 requests -- 34.65.21.34 - - [06/Sep/2026:10:28:52 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 34.65.21.34 - - [06/Sep/2026:10:28:52 +1000] "GET /Admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 34.65.21.34 - - [06/Sep/2026:10:28:49 +1000] "GET /.cursorrules HTTP/1.1" 404 127676 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 34.65.21.34 - - [06/Sep/2026:10:28:52 +1000] "GET /admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 34.65.21.34 - - [06/Sep/2026:10:28:50 +1000] "GET /www.zip HTTP/1.1" 404 127676 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 34.65.21.34 - - [06/Sep/2026:10:28:52 +1000] "GET /api/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 34.65.21.34 - - [06/Sep/2026:10:28:52 +1000] "GET /info.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 34.65.21.34 - - [06/Sep/2026:10:28:51 +1000] "GET /.config/fish/config.fish HTTP/1.1" 404 127676 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 34.65.21.34 - - [06/Sep/2026:10:28:51 +1000] "GET /litellm_config.yaml HTTP/1.1" 404 127676 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 34.65.21.34 - - [06/Sep/2026:10:28:51 +1000] "GET /backup.tgz HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-06 10:26:31 L1=1.36 run=2 blk=1 avail=10426(75.7%) swpO=0 conn=1 myRSS=1080 php=4 phpRSS=24 ap=13 tcp=33 topuser=root 2026-09-06 10:26:33 L1=1.33 run=2 blk=1 avail=10425(75.7%) swpO=0 conn=1 myRSS=1080 php=4 phpRSS=24 ap=13 tcp=34 topuser=root 2026-09-06 10:26:42 L1=1.30 run=2 blk=1 avail=10296(74.7%) swpO=0 conn=1 myRSS=1080 php=6 phpRSS=206 ap=13 tcp=32 topuser=madalice 2026-09-06 10:26:43 L1=1.28 run=1 blk=1 avail=10314(74.9%) swpO=0 conn=1 myRSS=1080 php=5 phpRSS=156 ap=13 tcp=33 topuser=madalice 2026-09-06 10:26:52 L1=1.34 run=1 blk=1 avail=10315(74.9%) swpO=0 conn=1 myRSS=1080 php=5 phpRSS=156 ap=13 tcp=35 topuser=madalice 2026-09-06 10:26:53 L1=1.39 run=3 blk=1 avail=10306(74.8%) swpO=0 conn=1 myRSS=1080 php=5 phpRSS=156 ap=13 tcp=56 topuser=madalice 2026-09-06 10:27:02 L1=1.68 run=4 blk=1 avail=10050(72.9%) swpO=24 conn=1 myRSS=1080 php=6 phpRSS=263 ap=41 tcp=47 topuser=olympic 2026-09-06 10:27:03 L1=1.86 run=2 blk=1 avail=10146(73.6%) swpO=24 conn=1 myRSS=1080 php=5 phpRSS=133 ap=40 tcp=39 topuser=madalice 2026-09-06 10:27:12 L1=1.96 run=2 blk=1 avail=10136(73.6%) swpO=0 conn=2 myRSS=1080 php=6 phpRSS=230 ap=31 tcp=41 topuser=madalice 2026-09-06 10:27:13 L1=2.04 run=1 blk=2 avail=10188(73.9%) swpO=0 conn=1 myRSS=1080 php=5 phpRSS=156 ap=30 tcp=41 topuser=madalice 2026-09-06 10:27:22 L1=1.96 run=3 blk=1 avail=10221(74.2%) swpO=56 conn=2 myRSS=1079 php=6 phpRSS=247 ap=21 tcp=34 topuser=madalice 2026-09-06 10:27:23 L1=2.20 run=6 blk=1 avail=10154(73.7%) swpO=56 conn=3 myRSS=1079 php=7 phpRSS=344 ap=20 tcp=35 topuser=madalice 2026-09-06 10:27:32 L1=2.18 run=2 blk=1 avail=10215(74.1%) swpO=13 conn=2 myRSS=1078 php=6 phpRSS=262 ap=19 tcp=38 topuser=madalice 2026-09-06 10:27:33 L1=2.09 run=3 blk=1 avail=10222(74.2%) swpO=13 conn=3 myRSS=1078 php=6 phpRSS=271 ap=19 tcp=37 topuser=madalice 2026-09-06 10:27:42 L1=2.16 run=2 blk=1 avail=10268(74.5%) swpO=18 conn=2 myRSS=1078 php=5 phpRSS=180 ap=17 tcp=31 topuser=madalice 2026-09-06 10:27:43 L1=2.15 run=2 blk=1 avail=10276(74.6%) swpO=18 conn=3 myRSS=1078 php=5 phpRSS=180 ap=17 tcp=30 topuser=madalice 2026-09-06 10:27:52 L1=2.14 run=4 blk=1 avail=10211(74.1%) swpO=18 conn=2 myRSS=1078 php=6 phpRSS=294 ap=16 tcp=27 topuser=madalice 2026-09-06 10:27:53 L1=2.05 run=3 blk=1 avail=10415(75.6%) swpO=18 conn=3 myRSS=1078 php=5 phpRSS=69 ap=16 tcp=27 topuser=olympic 2026-09-06 10:28:02 L1=2.04 run=2 blk=1 avail=10240(74.3%) swpO=0 conn=2 myRSS=1078 php=6 phpRSS=263 ap=16 tcp=30 topuser=madalice 2026-09-06 10:28:03 L1=2.04 run=1 blk=1 avail=10317(74.9%) swpO=0 conn=3 myRSS=1078 php=5 phpRSS=156 ap=16 tcp=29 topuser=madalice 2026-09-06 10:28:12 L1=2.04 run=2 blk=1 avail=10245(74.4%) swpO=0 conn=2 myRSS=1078 php=6 phpRSS=252 ap=16 tcp=30 topuser=madalice 2026-09-06 10:28:13 L1=2.11 run=1 blk=1 avail=10311(74.8%) swpO=0 conn=3 myRSS=1078 php=5 phpRSS=156 ap=16 tcp=31 topuser=madalice 2026-09-06 10:28:22 L1=2.10 run=3 blk=1 avail=10203(74.1%) swpO=16 conn=2 myRSS=1077 php=7 phpRSS=338 ap=16 tcp=34 topuser=aaa 2026-09-06 10:28:23 L1=2.18 run=2 blk=1 avail=10334(75.0%) swpO=16 conn=2 myRSS=1077 php=5 phpRSS=147 ap=16 tcp=33 topuser=olympic 2026-09-06 10:28:32 L1=2.08 run=4 blk=1 avail=10222(74.2%) swpO=0 conn=2 myRSS=1077 php=7 phpRSS=314 ap=16 tcp=32 topuser=madalice 2026-09-06 10:28:33 L1=2.24 run=3 blk=1 avail=10217(74.2%) swpO=0 conn=2 myRSS=1077 php=6 phpRSS=283 ap=16 tcp=32 topuser=madalice 2026-09-06 10:28:42 L1=2.14 run=1 blk=1 avail=10323(74.9%) swpO=0 conn=2 myRSS=1077 php=5 phpRSS=156 ap=16 tcp=28 topuser=madalice 2026-09-06 10:28:43 L1=2.04 run=1 blk=1 avail=10331(75.0%) swpO=0 conn=2 myRSS=1077 php=5 phpRSS=156 ap=15 tcp=28 topuser=madalice 2026-09-06 10:28:52 L1=2.84 run=13 blk=1 avail=8661 (62.9%) swpO=539 conn=14 myRSS=1079 php=20 phpRSS=1843 ap=43 tcp=55 topuser=evolution 2026-09-06 10:28:54 L1=5.42 run=26 blk=1 avail=8080 (58.7%) swpO=490 conn=21 myRSS=1085 php=25 phpRSS=2826 ap=42 tcp=36 topuser=evolution