INCIDENT 2026-09-07 10:58:53 trigger: php_rss=1505MB ================================================================== load: 2.77 2.14 2.19 12/714 2739273 ncpu:10 mem_avail: 7834MB/13777MB (56.9%) swap_used:2586MB swapout:596/s blocked(D):1 running:12 iowait:6.9% steal:0.0% php: 14 procs / 1505MB heaviest user: corpkicks (7 procs, 1151MB) apache: 50 procs tcp_estab: 60 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2293 corpkicks 7 1219 root 249 1027 nobody 49 837 netdata 8 243 madalice 1 153 speedlin 1 126 mailman 20 98 cpanellogin 1 88 evolution 12 66 wp-toolkit 3 55 dovenull 6 55 mailnull 3 24 kurri 2 24 dovecot 3 22 infinium 1 18 alison 1 15 zabbix 1 10 named 1 8 polkitd 1 6 --- php workers by user --- USER PROCS RSS_MB corpkicks 7 1233 madalice 1 153 speedlin 1 127 evolution 4 56 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6280 MB Active(file): 3070 MB Inactive(file): 3275 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 582 MB CommitLimit: 10984 MB Committed_AS: 9577 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-08:36:28 5184 /usr/bin/imunify-agent-proxy 4109079 root 2-06:14:06 1968 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-06:14:06 97364 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2348708 5.5 Ssl 1-15:22:23 /usr/sbin/mariadbd 2739230 2720255 corpkicks 245948 125 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2739232 2736986 corpkicks 245712 117 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2739234 2738647 corpkicks 226076 116 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2739233 2739025 corpkicks 222956 112 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2739238 2736897 corpkicks 214008 94.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 166870 1 netdata 185460 2.6 Ssl 1-08:36:34 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 923652 904997 root 160164 0.1 S 08:29:10 spamd child 2738775 167896 madalice 157116 11.9 S 00:31 php-fpm: pool madalice_com_au 167871 1 root 143236 0.0 Ss 1-08:36:27 /usr/lib/systemd/systemd-journald 923653 904997 root 142036 0.0 S 08:29:09 spamd child 2739236 2739039 speedlin 137536 106 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 904997 1 root 130732 0.0 Ss 08:35:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2739242 2736985 corpkicks 104272 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 4109105 4109079 root 97364 1.4 Sl 2-06:14:06 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2442021 1353308 cpanellogin 90436 0.0 S 01:19:28 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2739243 2739036 corpkicks 73304 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2739237 2736191 evolution 57928 10.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1469 1 root 41928 0.1 Ss 70-00:49:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41204 0.1 Ss 47-08:17:40 cpsrvd (SSL) - waiting for connections 2739306 2738412 evolution 35564 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 34572 0.0 Sl 10-08:39:14 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34520 0.1 Sl 1-08:36:29 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 31492 0.0 Ss 1-08:36:38 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29800 0.0 Ss 08:36:29 lfd - sleeping 167896 1 root 23700 0.0 Ss 1-08:36:26 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 23684 0.0 Ss 70-00:49:09 tailwatchd 2720255 506832 nobody 22000 0.1 S 05:04 /usr/sbin/httpd -k start 2736986 506832 nobody 21472 0.0 S 02:19 /usr/sbin/httpd -k start 2736119 506832 nobody 21460 0.0 S 03:09 /usr/sbin/httpd -k start 2720494 506832 nobody 21032 0.0 S 04:50 /usr/sbin/httpd -k start 2736897 506832 nobody 20880 0.0 S 02:21 /usr/sbin/httpd -k start 2736122 506832 nobody 20760 0.1 S 03:09 /usr/sbin/httpd -k start 2736985 506832 nobody 20728 0.0 S 02:19 /usr/sbin/httpd -k start 2736982 506832 nobody 20664 0.0 S 02:19 /usr/sbin/httpd -k start 2736191 506832 nobody 20612 0.0 S 03:05 /usr/sbin/httpd -k start 2738716 506832 nobody 20244 0.1 S 00:39 /usr/sbin/httpd -k start 2737046 506832 nobody 19704 0.0 S 02:16 /usr/sbin/httpd -k start 2735775 506832 nobody 19656 0.1 S 03:34 /usr/sbin/httpd -k start 2737058 506832 nobody 19644 0.0 S 02:15 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19508 0.0 Ss 1-08:36:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2739039 506832 nobody 19260 0.0 S 00:15 /usr/sbin/httpd -k start 2738752 167382 infinium 19244 0.4 S 00:34 dovecot/imap 2738681 506832 nobody 19240 0.1 S 00:40 /usr/sbin/httpd -k start 2739038 506832 nobody 19204 0.0 S 00:15 /usr/sbin/httpd -k start 2738647 506832 nobody 19064 0.0 S 00:41 /usr/sbin/httpd -k start 2738889 506832 nobody 18948 0.0 S 00:24 /usr/sbin/httpd -k start 2737459 506832 nobody 18944 0.1 S 01:51 /usr/sbin/httpd -k start 2739036 506832 nobody 18900 0.2 S 00:15 /usr/sbin/httpd -k start 2739037 506832 nobody 18888 0.1 S 00:15 /usr/sbin/httpd -k start 2738095 506832 nobody 18832 0.0 S 01:22 /usr/sbin/httpd -k start 2738718 506832 nobody 18816 0.2 S 00:39 /usr/sbin/httpd -k start 2737439 506832 nobody 18384 0.0 S 01:52 /usr/sbin/httpd -k start 2738909 506832 nobody 17840 0.0 S 00:22 /usr/sbin/httpd -k start 167566 166914 netdata 17832 2.1 Sl 1-08:36:29 /usr/libexec/netdata/plugins.d/apps.plugin 1 2739025 506832 nobody 17756 0.1 S 00:16 /usr/sbin/httpd -k start 2738861 506832 nobody 17628 0.0 S 00:27 /usr/sbin/httpd -k start 2736942 506832 nobody 17588 0.0 S 02:20 /usr/sbin/httpd -k start 2738412 506832 nobody 17384 0.1 S 01:05 /usr/sbin/httpd -k start 2738419 506832 nobody 17328 0.0 S 01:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------------------+--------------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------------------+--------------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2589630 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 2589559 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Waiting for table level lock | SELECT option_value FROM MPHOrV_options WHERE option_name = 'members_settings' LIMIT 1 | | 2589466 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Waiting for table level lock | SELECT option_name, option_value FROM MPHOrV_options WHERE option_name IN ('_transient_ti_sdk_pause_neve','_transient_timeout_ti_sdk_pause_neve') | | 2589461 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Waiting for table level lock | SELECT option_value FROM MPHOrV_options WHERE option_name = 'woocommerce_enable_delayed_account_creation' LIMIT 1 | | 2589460 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Sending data | SELECT option_value FROM MPHOrV_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | | 2589459 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Waiting for table level lock | SELECT autoload FROM MPHOrV_options WHERE option_name = 'eps_redirects_404_log' LIMIT 1 | | 2589450 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Waiting for table level lock | UPDATE `MPHOrV_options` SET `option_value` = 'a:50:{i:0;a:3:{s:9:\"timestamp\";i:1788742734;s:3:\"url\";s:12:\"/private-key\";s:10:\"user_agent\";s:68:\"Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)\";}i:1;a:3:{s:9:\"timestamp\";i:1788742731;s:3:\"url\";s:19:\"/webpack-stats.j | +---------+--------------------+--------------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2589559 | corpkicks_wp_baolr | 0 | Waiting for table level lock | SELECT option_value FROM MPHOrV_options WHERE option_name = 'members_settings' LIMIT 1 | | 2589466 | corpkicks_wp_baolr | 0 | Waiting for table level lock | SELECT option_name, option_value FROM MPHOrV_options WHERE option_name IN ('_transient_ti_sdk_pause_neve','_transient_timeout_ti_sdk_pause_neve') | | 2589461 | corpkicks_wp_baolr | 0 | Waiting for table level lock | SELECT option_value FROM MPHOrV_options WHERE option_name = 'woocommerce_enable_delayed_account_creation' LIMIT 1 | | 2589459 | corpkicks_wp_baolr | 0 | Waiting for table level lock | SELECT autoload FROM MPHOrV_options WHERE option_name = 'eps_redirects_404_log' LIMIT 1 | | 2589450 | corpkicks_wp_baolr | 0 | Waiting for table level lock | UPDATE `MPHOrV_options` SET `option_value` = 'a:50:{i:0;a:3:{s:9:\"timestamp\";i:1788742734;s:3:\"url\";s:12:\"/private-key\";s:10:\"user_agent\";s:68:\"Mozilla/5.0 (compatible; Hunyuan/1.0; +https:// | +---------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 814 infinium/infinium.net.au-ssl_log 276 whiz/whizengineering.com.au-ssl_log 134 evolution/app.evolutionerp.com.au-ssl_log 131 evolution/portal.evolutionerp.com.au-ssl_log 76 aaa/aaadownunder.com.au-ssl_log 27 corpkicks/corporatekicks.com.au-ssl_log 11 madalice/madalice.com.au-ssl_log 10 alison/alisonarts.com.au-ssl_log 4 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 487 203.54.180.238 273 45.148.10.9 138 103.104.165.99 134 34.93.121.246 131 40.115.94.245 126 116.91.221.245 53 103.104.164.114 39 1.145.70.156 16 182.239.240.254 16 180.181.236.49 16 1.145.73.60 9 34.75.226.236 6 52.167.144.228 5 118.127.40.55 4 85.204.70.96 --- top request paths across all vhosts (last 3 min) --- 294 POST /functions.php 140 GET /app/ajax.php 102 GET /api/getItem/LWFBW2001KG 91 GET /index.php 49 POST /plugins/csvexporter/plugin.php 48 GET /heartbeat.php 32 POST /app/ajax/selectFilter.php 23 POST /app/ajax/selectFilterSingle.php 22 POST /clienteditsave.php 21 POST /wp/ 21 POST /wordpress/ 21 POST /blog/ 21 POST /app/ajax.php 21 POST /app/ajax/contactFilter.php 20 POST /quoteditsave.php 20 POST /itemModify.php 14 POST /wp/index.php 14 POST /wordpress/index.php 14 POST /blog/index.php 12 GET / --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 294 POST /functions.php 140 GET /app/ajax.php 81 GET /index.php 49 POST /plugins/csvexporter/plugin.php 32 POST /app/ajax/selectFilter.php 23 POST /app/ajax/selectFilterSingle.php 22 POST /clienteditsave.php 21 POST /app/ajax.php 21 POST /app/ajax/contactFilter.php 20 POST /quoteditsave.php 20 POST /itemModify.php 11 POST /inveditsave.php -- last 10 requests -- 116.91.221.245 - - [07/Sep/2026:10:58:51 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=16389160889 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 116.91.221.245 - - [07/Sep/2026:10:58:51 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dinveditupload%26id%3D2887%26string%3D&call=getUserSetting&caller=ajaxSubmitLocal&seq=18297638938 HTTP/1.1" 200 103.104.165.99 - - [07/Sep/2026:10:58:51 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=70053" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 116.91.221.245 - - [07/Sep/2026:10:58:51 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinveditupload%26id%3D2887%26string%3D&call=getUserSetting&caller=ajaxSubmitLocal&seq=12089297574 HTTP/1.1" 200 110 "https://my.e 116.91.221.245 - - [07/Sep/2026:10:58:52 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4433" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 116.91.221.245 - - [07/Sep/2026:10:58:52 +1000] "POST /app/ajax.php?cn=&furi=true&uri=page%3Dopportunityedit%26opportunityid%3D135 HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=opportunityedit&opportuni 116.91.221.245 - - [07/Sep/2026:10:58:52 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 12043 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4433" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) App 116.91.221.245 - - [07/Sep/2026:10:58:52 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inveditupload&id=2887&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 1.145.70.156 - - [07/Sep/2026:10:58:52 +1000] "POST /quoteditsave.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37112" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 203.54.180.238 - - [07/Sep/2026:10:58:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29586&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; == infinium/infinium.net.au-ssl_log == -- top paths -- 21 POST /wp/ 21 POST /wordpress/ 21 POST /blog/ 14 POST /wp/index.php 14 POST /wordpress/index.php 14 POST /blog/index.php 9 GET /wp/ 9 GET /wordpress/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 -- last 10 requests -- 45.148.10.9 - - [07/Sep/2026:10:57:40 +1000] "POST /blog/wp-json/batch/v1 HTTP/1.1" 404 3417 "https://cpanel.infinium.net.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.9 - - [07/Sep/2026:10:57:41 +1000] "POST /blog/wp-json/Batch/v1 HTTP/1.1" 404 3417 "https://cpanel.infinium.net.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.9 - - [07/Sep/2026:10:57:41 +1000] "POST /blog//wp-json/batch/v1 HTTP/1.1" 404 3417 "https://cpanel.infinium.net.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.9 - - [07/Sep/2026:10:57:41 +1000] "POST /blog/wp-json/batch/v1/ HTTP/1.1" 404 3417 "https://cpanel.infinium.net.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.9 - - [07/Sep/2026:10:57:42 +1000] "POST /blog/blog/wp-json/batch/v1 HTTP/1.1" 404 3417 "https://cpanel.infinium.net.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.9 - - [07/Sep/2026:10:57:42 +1000] "POST /blog/wordpress/wp-json/batch/v1 HTTP/1.1" 404 3417 "https://cpanel.infinium.net.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.9 - - [07/Sep/2026:10:57:42 +1000] "GET /blog/wp/v2/posts/999999 HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:10:57:43 +1000] "GET /blog/?rest_route=/wp/v2/posts/999999 HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 45.148.10.9 - - [07/Sep/2026:10:57:43 +1000] "GET /blog/wp/v2/pages HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:10:57:43 +1000] "GET /blog/?rest_route=/wp/v2/pages HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == whiz/whizengineering.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vue/.env 1 GET /vendor/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /v3/.env -- last 10 requests -- 34.93.121.246 - - [07/Sep/2026:10:58:51 +1000] "GET /user-panel/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.93.121.246 - - [07/Sep/2026:10:58:51 +1000] "GET /node/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.93.121.246 - - [07/Sep/2026:10:58:51 +1000] "GET /express/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.93.121.246 - - [07/Sep/2026:10:58:52 +1000] "GET /next/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.93.121.246 - - [07/Sep/2026:10:58:52 +1000] "GET /nuxt/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.93.121.246 - - [07/Sep/2026:10:58:52 +1000] "GET /nest/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.93.121.246 - - [07/Sep/2026:10:58:52 +1000] "GET /react/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.93.121.246 - - [07/Sep/2026:10:58:52 +1000] "GET /vue/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.93.121.246 - - [07/Sep/2026:10:58:53 +1000] "GET /angular/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.93.121.246 - - [07/Sep/2026:10:58:53 +1000] "GET /svelte/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-07 10:56:24 L1=1.88 run=2 blk=1 avail=8923 (64.8%) swpO=0 conn=1 myRSS=2307 php=6 phpRSS=203 ap=41 tcp=40 topuser=madalice 2026-09-07 10:56:33 L1=2.29 run=3 blk=1 avail=8762 (63.6%) swpO=2 conn=1 myRSS=2307 php=13 phpRSS=535 ap=42 tcp=61 topuser=evolution 2026-09-07 10:56:34 L1=2.29 run=2 blk=1 avail=8814 (64.0%) swpO=2 conn=2 myRSS=2307 php=9 phpRSS=349 ap=46 tcp=60 topuser=evolution 2026-09-07 10:56:43 L1=2.16 run=4 blk=1 avail=8748 (63.5%) swpO=40 conn=1 myRSS=2306 php=7 phpRSS=295 ap=58 tcp=44 topuser=madalice 2026-09-07 10:56:44 L1=2.16 run=2 blk=1 avail=8818 (64.0%) swpO=40 conn=2 myRSS=2306 php=5 phpRSS=180 ap=57 tcp=41 topuser=madalice 2026-09-07 10:56:53 L1=2.14 run=2 blk=1 avail=8607 (62.5%) swpO=0 conn=2 myRSS=2306 php=7 phpRSS=499 ap=48 tcp=40 topuser=evolution 2026-09-07 10:56:54 L1=2.14 run=3 blk=1 avail=9010 (65.4%) swpO=0 conn=2 myRSS=2306 php=4 phpRSS=23 ap=47 tcp=41 topuser=root 2026-09-07 10:57:03 L1=1.97 run=3 blk=1 avail=8813 (64.0%) swpO=0 conn=2 myRSS=2306 php=6 phpRSS=218 ap=58 tcp=53 topuser=madalice 2026-09-07 10:57:04 L1=1.97 run=2 blk=1 avail=8656 (62.8%) swpO=0 conn=2 myRSS=2306 php=6 phpRSS=374 ap=58 tcp=52 topuser=corpkicks 2026-09-07 10:57:13 L1=2.19 run=2 blk=1 avail=8708 (63.2%) swpO=74 conn=2 myRSS=2304 php=7 phpRSS=387 ap=49 tcp=48 topuser=madalice 2026-09-07 10:57:14 L1=2.19 run=2 blk=1 avail=8720 (63.3%) swpO=74 conn=2 myRSS=2304 php=7 phpRSS=378 ap=48 tcp=42 topuser=madalice 2026-09-07 10:57:23 L1=2.16 run=3 blk=1 avail=8770 (63.7%) swpO=0 conn=2 myRSS=2304 php=7 phpRSS=361 ap=43 tcp=49 topuser=madalice 2026-09-07 10:57:24 L1=2.16 run=3 blk=1 avail=8798 (63.9%) swpO=0 conn=2 myRSS=2304 php=7 phpRSS=349 ap=43 tcp=50 topuser=madalice 2026-09-07 10:57:33 L1=2.14 run=2 blk=1 avail=8866 (64.4%) swpO=0 conn=2 myRSS=2305 php=6 phpRSS=245 ap=43 tcp=52 topuser=madalice 2026-09-07 10:57:34 L1=2.14 run=5 blk=1 avail=8864 (64.3%) swpO=0 conn=1 myRSS=2305 php=6 phpRSS=233 ap=44 tcp=48 topuser=madalice 2026-09-07 10:57:43 L1=2.12 run=1 blk=1 avail=8905 (64.6%) swpO=0 conn=2 myRSS=2305 php=5 phpRSS=177 ap=44 tcp=44 topuser=madalice 2026-09-07 10:57:44 L1=2.12 run=3 blk=1 avail=8903 (64.6%) swpO=0 conn=1 myRSS=2305 php=5 phpRSS=177 ap=43 tcp=42 topuser=madalice 2026-09-07 10:57:53 L1=2.10 run=1 blk=1 avail=8916 (64.7%) swpO=0 conn=1 myRSS=2306 php=5 phpRSS=179 ap=43 tcp=45 topuser=madalice 2026-09-07 10:57:54 L1=2.10 run=2 blk=1 avail=8830 (64.1%) swpO=0 conn=1 myRSS=2306 php=6 phpRSS=294 ap=43 tcp=40 topuser=madalice 2026-09-07 10:58:03 L1=1.93 run=1 blk=1 avail=8985 (65.2%) swpO=0 conn=1 myRSS=2306 php=5 phpRSS=179 ap=34 tcp=31 topuser=madalice 2026-09-07 10:58:04 L1=1.93 run=1 blk=1 avail=8993 (65.3%) swpO=0 conn=1 myRSS=2306 php=5 phpRSS=179 ap=33 tcp=27 topuser=madalice 2026-09-07 10:58:13 L1=1.79 run=3 blk=1 avail=9096 (66.0%) swpO=0 conn=1 myRSS=2306 php=6 phpRSS=136 ap=28 tcp=41 topuser=aaa 2026-09-07 10:58:14 L1=1.79 run=1 blk=1 avail=9029 (65.5%) swpO=0 conn=1 myRSS=2306 php=6 phpRSS=178 ap=30 tcp=41 topuser=aaa 2026-09-07 10:58:23 L1=1.74 run=3 blk=1 avail=8868 (64.4%) swpO=0 conn=1 myRSS=2306 php=5 phpRSS=268 ap=34 tcp=41 topuser=madalice 2026-09-07 10:58:24 L1=1.74 run=1 blk=1 avail=8985 (65.2%) swpO=0 conn=1 myRSS=2306 php=5 phpRSS=155 ap=34 tcp=45 topuser=madalice 2026-09-07 10:58:33 L1=1.63 run=3 blk=1 avail=8954 (65.0%) swpO=0 conn=1 myRSS=2306 php=6 phpRSS=197 ap=38 tcp=49 topuser=madalice 2026-09-07 10:58:34 L1=1.63 run=3 blk=1 avail=8877 (64.4%) swpO=0 conn=3 myRSS=2306 php=6 phpRSS=267 ap=38 tcp=46 topuser=madalice 2026-09-07 10:58:43 L1=1.68 run=3 blk=1 avail=8830 (64.1%) swpO=0 conn=1 myRSS=2306 php=7 phpRSS=277 ap=48 tcp=59 topuser=madalice 2026-09-07 10:58:44 L1=1.68 run=2 blk=1 avail=8649 (62.8%) swpO=0 conn=3 myRSS=2306 php=6 phpRSS=429 ap=48 tcp=57 topuser=corpkicks 2026-09-07 10:58:53 L1=2.77 run=12 blk=1 avail=7834 (56.9%) swpO=596 conn=10 myRSS=2293 php=14 phpRSS=1505 ap=50 tcp=60 topuser=corpkicks