================================================================ ### BASIC INFO ================================================================ Timestamp: Tue Sep 22 22:46:43 +08 2026 Host: ns600.locus-t.com.my 22:46:43 up 3 days, 15:21, 1 user, load average: 9.98, 7.74, 6.92 Linux ns600.locus-t.com.my 4.18.0-553.157.1.lve.el8.x86_64 #1 SMP Mon Aug 24 17:05:39 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux ================================================================ ### CPU / MEMORY SNAPSHOT ================================================================ top - 22:46:43 up 3 days, 15:21, 1 user, load average: 9.98, 7.74, 6.92 Tasks: 357 total, 12 running, 344 sleeping, 0 stopped, 1 zombie %Cpu(s): 59.2 us, 6.2 sy, 0.0 ni, 23.8 id, 10.8 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 31716.6 total, 5319.7 free, 14653.0 used, 11743.9 buff/cache MiB Swap: 16052.0 total, 14062.4 free, 1989.6 used. 14697.1 avail Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1088907 root 20 0 3777220 3.3g 2768 R 100.0 10.6 8:06.80 lfd - r+ 1094469 syntecco 20 0 1276928 210784 41016 R 93.8 0.6 0:01.24 php-fpm 1089131 greenfee 20 0 1280872 222620 48956 R 62.5 0.7 2:06.71 php-fpm 1094451 gpvcom 20 0 1204228 137248 40120 R 43.8 0.4 0:00.88 php-fpm 1094454 gpvcom 20 0 1181636 114108 40124 R 43.8 0.4 0:00.68 php-fpm 1094447 gpvcom 20 0 1237228 169448 40120 R 37.5 0.5 0:01.08 php-fpm 1094456 gpvcom 20 0 1175488 107644 40124 R 37.5 0.3 0:00.63 php-fpm 1094452 gpvcom 20 0 1183684 116988 40124 R 31.2 0.4 0:00.70 php-fpm 1094455 gpvcom 20 0 1185728 119424 40128 R 25.0 0.4 0:00.72 php-fpm 1094453 gpvcom 20 0 1198084 129588 40124 R 18.8 0.4 0:00.81 php-fpm 1094423 gpvcom 20 0 1264472 201384 44692 R 12.5 0.6 0:02.81 php-fpm 3018 mysql 20 0 13.2g 4.8g 19496 S 6.2 15.6 364:33.31 mysqld 1094486 root 20 0 49696 4244 3348 R 6.2 0.0 0:00.01 top 1 root 20 0 313660 11296 7456 S 0.0 0.0 11:10.26 systemd 2 root 20 0 0 0 0 S 0.0 0.0 0:00.23 kthreadd 3 root 0 -20 0 0 0 I 0.0 0.0 0:00.00 rcu_gp 4 root 0 -20 0 0 0 I 0.0 0.0 0:00.00 rcu_par+ 5 root 0 -20 0 0 0 I 0.0 0.0 0:00.00 slub_fl+ 7 root 0 -20 0 0 0 I 0.0 0.0 0:00.00 kworker+ 10 root 0 -20 0 0 0 I 0.0 0.0 0:00.00 mm_perc+ 11 root 20 0 0 0 0 S 0.0 0.0 0:00.00 rcu_tas+ 12 root 20 0 0 0 0 S 0.0 0.0 0:00.00 rcu_tas+ 13 root 20 0 0 0 0 S 0.0 0.0 0:26.88 ksoftir+ 14 root 20 0 0 0 0 I 0.0 0.0 3:46.75 rcu_sch+ 15 root rt 0 0 0 0 S 0.0 0.0 0:03.52 migrati+ 16 root rt 0 0 0 0 S 0.0 0.0 0:00.14 watchdo+ 17 root 20 0 0 0 0 S 0.0 0.0 0:00.00 cpuhp/0 18 root 20 0 0 0 0 S 0.0 0.0 0:00.00 cpuhp/1 ================================================================ ### LOAD-RELATED PROCESS STATES ================================================================ --- Running / uninterruptible tasks --- S PID PPID USER %CPU %MEM ELAPSED WCHAN CMD R 1088907 3691 root 88.1 10.5 09:12 - lfd - retrieving blocklist SPAMDROP R 1094469 3666869 syntecco 63.0 0.6 00:02 - php-fpm: pool syntec_com_my R 1094423 3666869 gpvcom 46.8 0.6 00:06 - php-fpm: pool gpv_com_my R 1094447 3666869 gpvcom 36.0 0.5 00:03 - php-fpm: pool gpv_com_my R 1094451 3666869 gpvcom 29.3 0.4 00:03 - php-fpm: pool gpv_com_my R 1094453 3666869 gpvcom 27.0 0.3 00:03 - php-fpm: pool gpv_com_my R 1089131 3666869 greenfee 26.6 0.6 07:55 - php-fpm: pool greenfeed_com_my R 1094455 3666869 gpvcom 24.0 0.3 00:03 - php-fpm: pool gpv_com_my R 1094452 3666869 gpvcom 23.3 0.3 00:03 - php-fpm: pool gpv_com_my R 1094454 3666869 gpvcom 22.6 0.3 00:03 - php-fpm: pool gpv_com_my R 1094456 3666869 gpvcom 21.3 0.3 00:03 - php-fpm: pool gpv_com_my R 1675 1 cpanelc+ 0.1 0.0 3-15:20:50 - /usr/local/cpanel/3rdparty/sbin/p0f -i any -u cpanelconnecttrack -d -s /var/cpanel/userhomes/cpanelconnecttrack/p0f.socket less 400 and not dst port 80 and not dst port 443 and tcp[13] & 8==0 R 1474 1426 mailman 0.0 0.0 3-15:20:52 - /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s R 1094488 1094472 root 0.0 0.0 00:00 - ps -eo state,pid,ppid,user,%cpu,%mem,etime,wchan:24,cmd --sort=-%cpu ================================================================ ### TOP CPU PROCESSES ================================================================ USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1088907 88.1 10.5 3777220 3440268 ? R 22:37 8:06 lfd - retrieving blocklist SPAMDROP syntecco 1094469 63.5 0.6 1283136 216240 ? R 22:46 0:01 php-fpm: pool syntec_com_my gpvcom 1094423 46.8 0.6 1264472 201384 ? R 22:46 0:02 php-fpm: pool gpv_com_my gpvcom 1094447 36.0 0.5 1237228 169448 ? R 22:46 0:01 php-fpm: pool gpv_com_my gpvcom 1094451 29.3 0.4 1204228 137248 ? R 22:46 0:00 php-fpm: pool gpv_com_my gpvcom 1094453 27.0 0.3 1198084 129588 ? R 22:46 0:00 php-fpm: pool gpv_com_my greenfee 1089131 26.6 0.6 1280872 222620 ? R 22:38 2:06 php-fpm: pool greenfeed_com_my greenfee 1089098 26.1 0.6 1280768 222576 ? S 22:38 2:09 php-fpm: pool greenfeed_com_my greenfee 1089051 26.0 0.6 1279904 222020 ? S 22:38 2:12 php-fpm: pool greenfeed_com_my gpvcom 1094455 24.0 0.3 1185728 119424 ? R 22:46 0:00 php-fpm: pool gpv_com_my gpvcom 1094452 23.3 0.3 1183684 116988 ? R 22:46 0:00 php-fpm: pool gpv_com_my gpvcom 1094454 22.6 0.3 1181636 114108 ? R 22:46 0:00 php-fpm: pool gpv_com_my gpvcom 1094456 21.3 0.3 1175488 107908 ? R 22:46 0:00 php-fpm: pool gpv_com_my root 1089206 7.4 0.4 792848 155576 ? S 22:39 0:34 /usr/bin/python3 /usr/local/cpanel/bin/packman_get_list_json all ea-php*-php-common root 1093786 7.1 1.2 509548 409520 ? Ssl 22:45 0:05 /opt/rustbolit/rustbolit --resident --with-suspicious --smart --cloud-assist=AUTO --use-heuristics-ignore --deobfuscate --memory=2G --no-html --avdb=/var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --skip-system-owner --skip-imunify360-storage --encode-b64-filenames --scan-archive --hs=/var/imunify360/files/sigs/v1/aibolit/hyperscan mysql 3018 6.9 15.5 13867096 5059136 ? Ssl Sep19 364:33 /usr/sbin/mysqld toitoic1 1093939 5.8 0.8 1415100 281052 ? S 22:45 0:02 php-fpm: pool toitoi_com_hk root 1094458 3.6 0.0 105752 24316 ? Ss 22:46 0:00 /usr/sbin/exim -Mc 1x91lX-00000004aiH-48WY compedo+ 1094106 2.5 0.1 769744 56600 ? S 22:46 0:00 php-fpm: pool compedo_com_my root 1094179 1.8 0.1 574924 56884 ? S 22:46 0:00 /usr/libexec/platform-python /usr/bin/needs-restarting --reboothint root 37507 1.4 0.5 4507092 176372 ? Ssl 00:52 18:25 /usr/bin/imunify-resident compedo+ 1094120 1.3 0.1 763604 50460 ? S 22:46 0:00 php-fpm: pool compedo_com_my compedo+ 1094107 1.2 0.1 763604 50444 ? S 22:46 0:00 php-fpm: pool compedo_com_my compedo+ 1094109 1.2 0.1 763604 50444 ? S 22:46 0:00 php-fpm: pool compedo_com_my nobody 1092133 0.9 0.7 3866940 230916 ? Sl 22:44 0:01 /usr/sbin/httpd -k start wp-tool+ 1094028 0.9 0.1 577692 47260 ? S 22:46 0:00 sw-engine-fpm: pool wordpress-toolkit nobody 1080335 0.7 0.8 4002116 276188 ? Sl 22:20 0:11 /usr/sbin/httpd -k start nobody 1080333 0.5 0.7 3866940 255876 ? Sl 22:20 0:08 /usr/sbin/httpd -k start mailnull 1094468 0.5 0.0 106284 22728 ? S 22:46 0:00 /usr/sbin/exim -Mc 1x91lX-00000004aiH-48WY ================================================================ ### TOP MEMORY PROCESSES ================================================================ USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND mysql 3018 6.9 15.5 13867096 5059136 ? Ssl Sep19 364:33 /usr/sbin/mysqld root 1088907 88.1 10.5 3777220 3440268 ? R 22:37 8:06 lfd - retrieving blocklist SPAMDROP cpanels+ 3717 0.2 2.1 6650416 701684 ? Sl Sep19 11:53 /usr/lib/jvm/jre-11/bin/java -server -Xms512m -Xmx512m -XX:+UseG1GC -XX:+PerfDisableSharedMem -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=250 -XX:+UseLargePages -XX:+AlwaysPreTouch -XX:+ExplicitGCInvokesConcurrent -Xlog:gc*:file=/home/cpanelsolr/server/logs/solr_gc.log:time,uptime:filecount=9,filesize=20M -Dsolr.jetty.inetaccess.includes= -Dsolr.jetty.inetaccess.excludes= -Dsolr.log.dir=/home/cpanelsolr/server/logs -Djetty.port=8984 -DSTOP.PORT=7984 -Dhost=127.0.0.1 -Duser.timezone=UTC -XX:-OmitStackTraceInFastThrow -XX:+CrashOnOutOfMemoryError -XX:ErrorFile=/home/cpanelsolr/server/logs/jvm_crash_%p.log -Djetty.home=/home/cpanelsolr/server -Dsolr.solr.home=/home/cpanelsolr/server/solr -Dsolr.install.dir=/home/cpanelsolr -Dsolr.install.symDir=/home/cpanelsolr -Dsolr.default.confdir=/home/cpanelsolr/server/solr/configsets/_default/conf -Xss256k -Djava.security.manager -Djava.security.policy=/home/cpanelsolr/server/etc/security.policy -Djava.security.properties=/home/cpanelsolr/server/etc/security.properties -Dsolr.internal.network.permission=* -DdisableAdminUI=false -Dlog4j2.formatMsgNoLookups=true -Dsolr.autoSoftCommit.maxTime=3000 -Dsolr.log.muteconsole -jar start.jar --module=http --module=requestlog --module=gzip root 1093786 7.1 1.2 509548 409520 ? Ssl 22:45 0:05 /opt/rustbolit/rustbolit --resident --with-suspicious --smart --cloud-assist=AUTO --use-heuristics-ignore --deobfuscate --memory=2G --no-html --avdb=/var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --skip-system-owner --skip-imunify360-storage --encode-b64-filenames --scan-archive --hs=/var/imunify360/files/sigs/v1/aibolit/hyperscan nobody 1080334 0.4 0.9 4476296 302456 ? Sl 22:20 0:07 /usr/sbin/httpd -k start toitoic1 1093939 5.8 0.8 1415100 281052 ? S 22:45 0:02 php-fpm: pool toitoi_com_hk nobody 1080335 0.7 0.8 4002116 276188 ? Sl 22:20 0:11 /usr/sbin/httpd -k start nobody 1080278 0.3 0.8 4677996 265644 ? Sl 22:20 0:05 /usr/sbin/httpd -k start nobody 1080332 0.4 0.8 3866940 262224 ? Sl 22:20 0:07 /usr/sbin/httpd -k start nobody 1080333 0.5 0.7 3866940 255876 ? Sl 22:20 0:08 /usr/sbin/httpd -k start nobody 1092133 0.9 0.7 3866940 230916 ? Sl 22:44 0:01 /usr/sbin/httpd -k start root 37425 0.2 0.6 2570784 222840 ? Ssl 00:52 3:08 /usr/sbin/imunify360-php-daemon -idle_timeout 600 greenfee 1089131 26.6 0.6 1280872 222620 ? R 22:38 2:06 php-fpm: pool greenfeed_com_my greenfee 1089098 26.1 0.6 1280768 222576 ? S 22:38 2:09 php-fpm: pool greenfeed_com_my greenfee 1089051 26.0 0.6 1279904 222020 ? S 22:38 2:12 php-fpm: pool greenfeed_com_my syntecco 1094469 64.5 0.6 1285184 218608 ? R 22:46 0:01 php-fpm: pool syntec_com_my root 961699 0.1 0.6 342980 205436 ? S 19:07 0:24 spamd child gpvcom 1094423 46.8 0.6 1264472 201384 ? R 22:46 0:02 php-fpm: pool gpv_com_my root 1083759 0.0 0.5 326344 189024 ? S 22:28 0:00 spamd child root 25824 0.0 0.5 473832 183100 ? Ss Sep19 0:40 /usr/sbin/httpd -k start root 51084 0.0 0.5 309912 178232 ? Ss 01:04 0:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 --pidfile=/var/run/spamd.pid --listen=5 --listen=6 root 37507 1.4 0.5 4507092 176372 ? Ssl 00:52 18:25 /usr/bin/imunify-resident mongod 2354 0.1 0.5 1805000 175396 ? Sl Sep19 5:22 /usr/local/jetapps/usr/bin/mongod --quiet -f /usr/local/jetapps/etc/mongod.conf run gpvcom 1094447 36.0 0.5 1237228 169448 ? R 22:46 0:01 php-fpm: pool gpv_com_my ================================================================ ### PHP-FPM POOLS ================================================================ syntecco 1094469 3666869 66.5 0.6 00:02 php-fpm: pool syntec_com_my gpvcom 1094423 3666869 46.8 0.6 00:06 php-fpm: pool gpv_com_my gpvcom 1094447 3666869 36.3 0.5 00:03 php-fpm: pool gpv_com_my gpvcom 1094451 3666869 30.3 0.4 00:03 php-fpm: pool gpv_com_my gpvcom 1094453 3666869 27.6 0.4 00:03 php-fpm: pool gpv_com_my greenfee 1089131 3666869 26.6 0.6 07:55 php-fpm: pool greenfeed_com_my greenfee 1089098 3666869 26.1 0.6 08:16 php-fpm: pool greenfeed_com_my greenfee 1089051 3666869 26.0 0.6 08:27 php-fpm: pool greenfeed_com_my gpvcom 1094452 3666869 24.3 0.3 00:03 php-fpm: pool gpv_com_my gpvcom 1094455 3666869 24.3 0.3 00:03 php-fpm: pool gpv_com_my gpvcom 1094454 3666869 23.6 0.3 00:03 php-fpm: pool gpv_com_my gpvcom 1094456 3666869 22.0 0.3 00:03 php-fpm: pool gpv_com_my toitoic1 1093939 3666869 5.8 0.8 00:51 php-fpm: pool toitoi_com_hk compedo+ 1094106 3666869 2.5 0.1 00:22 php-fpm: pool compedo_com_my compedo+ 1094120 3666869 1.3 0.1 00:21 php-fpm: pool compedo_com_my compedo+ 1094107 3666869 1.2 0.1 00:22 php-fpm: pool compedo_com_my compedo+ 1094109 3666869 1.2 0.1 00:22 php-fpm: pool compedo_com_my compedo+ 1094279 3666869 0.0 0.0 00:12 php-fpm: pool compedo_com_my cpanelp+ 1094399 17434 0.0 0.0 00:10 php-fpm: pool cpanelphpmyadmin --- PHP-FPM process count by user --- 8 gpvcom 5 compedo+ 3 greenfee 1 toitoic1 1 syntecco 1 root 1 cpanelp+ ================================================================ ### MYSQL ================================================================ --- mysqld process --- mysql 3018 6.9 15.5 13867096 5059136 ? Ssl Sep19 364:33 /usr/sbin/mysqld --- processlist --- +--------+----------------------+-----------+--------------------+---------+--------+------------------------+------------------+ | Id | User | Host | db | Command | Time | State | Info | +--------+----------------------+-----------+--------------------+---------+--------+------------------------+------------------+ | 5 | event_scheduler | localhost | | Daemon | 314145 | Waiting on empty queue | | | 449590 | root | localhost | | Sleep | 3 | | | | 640191 | toitoic1_wp_wk2vg | localhost | toitoic1_wp_p0b9e | Sleep | 2 | | | | 640282 | gpvcom_wp_jch6z | localhost | gpvcom_wp_2sonj | Sleep | 0 | | | | 640283 | gpvcom_wp_jch6z | localhost | gpvcom_wp_2sonj | Sleep | 0 | | | | 640285 | gpvcom_wp_jch6z | localhost | gpvcom_wp_2sonj | Sleep | 0 | | | | 640286 | gpvcom_wp_jch6z | localhost | gpvcom_wp_2sonj | Sleep | 0 | | | | 640287 | gpvcom_wp_jch6z | localhost | gpvcom_wp_2sonj | Sleep | 0 | | | | 640288 | gpvcom_wp_jch6z | localhost | gpvcom_wp_2sonj | Sleep | 0 | | | | 640289 | gpvcom_wp_jch6z | localhost | gpvcom_wp_2sonj | Sleep | 0 | | | | 640290 | gpvcom_wp_jch6z | localhost | gpvcom_wp_2sonj | Sleep | 0 | | | | 640292 | syntecco_adminsyntec | localhost | syntecco_dbsyntech | Sleep | 0 | | | | 640294 | greenfee_f0h6e | localhost | greenfee_f0h6e | Sleep | 0 | | | | 640295 | root | localhost | | Query | 0 | init | show processlist | +--------+----------------------+-----------+--------------------+---------+--------+------------------------+------------------+ ================================================================ ### DISK / I/O ================================================================ Filesystem Type Size Used Avail Use% Mounted on devtmpfs devtmpfs 16G 0 16G 0% /dev tmpfs tmpfs 16G 0 16G 0% /dev/shm tmpfs tmpfs 16G 1.3G 15G 8% /run tmpfs tmpfs 16G 0 16G 0% /sys/fs/cgroup /dev/sda4 ext4 295G 31G 249G 11% / /dev/sda2 xfs 1014M 314M 701M 31% /boot /dev/sda1 vfat 599M 6.2M 593M 2% /boot/efi /dev/sda6 ext4 49G 3.5M 47G 1% /tmp /dev/sda3 ext4 3.1T 803G 2.1T 28% /home /dev/sda5 ext4 196G 38G 149G 21% /var none tmpfs 16G 4.0K 16G 1% /var/lve/dbgovernor-shm /dev/sda7 ext4 16G 100K 15G 1% /var/tmp tmpfs tmpfs 3.1G 0 3.1G 0% /run/user/0 --- iostat --- Linux 4.18.0-553.157.1.lve.el8.x86_64 (ns600.locus-t.com.my) 09/22/26 _x86_64_ (8 CPU) avg-cpu: %user %nice %system %iowait %steal %idle 32.95 1.18 4.53 6.79 0.00 54.56 Device r/s w/s rkB/s wkB/s rrqm/s wrqm/s %rrqm %wrqm r_await w_await aqu-sz rareq-sz wareq-sz svctm %util sda 70.75 62.03 1561.56 1180.78 6.05 76.93 7.88 55.36 13.26 84.10 6.16 22.07 19.04 3.13 41.59 avg-cpu: %user %nice %system %iowait %steal %idle 55.00 0.00 5.88 1.50 0.00 37.62 Device r/s w/s rkB/s wkB/s rrqm/s wrqm/s %rrqm %wrqm r_await w_await aqu-sz rareq-sz wareq-sz svctm %util sda 2.00 20.00 12.00 276.00 0.00 25.00 0.00 55.56 18.50 12.05 0.28 6.00 13.80 8.45 18.60 avg-cpu: %user %nice %system %iowait %steal %idle 56.66 0.00 4.90 1.38 0.00 37.06 Device r/s w/s rkB/s wkB/s rrqm/s wrqm/s %rrqm %wrqm r_await w_await aqu-sz rareq-sz wareq-sz svctm %util sda 0.00 16.00 0.00 252.00 0.00 23.00 0.00 58.97 0.00 13.12 0.21 0.00 15.75 9.50 15.20 ================================================================ ### LFD / CSF ================================================================ --- Active LFD processes --- root 3691 0.1 0.0 300400 18556 ? Ss 00:00 1:41 lfd - sleeping root 1088907 88.2 10.5 3777220 3440268 ? R 22:37 8:08 lfd - retrieving blocklist SPAMDROP --- LF_IPSET --- LF_IPSET = "1" LF_IPSET_HASHSIZE = "1048576" LF_IPSET_MAXELEM = "16777216" --- Enabled blocklists of interest --- --- Recent blocklist activity --- Sep 22 18:18:20 ns600 lfd[931502]: Retrieved and blocking blocklist INTERSERVER IP address ranges Sep 22 18:20:46 ns600 lfd[931502]: Retrieved and blocking blocklist MERBL IP address ranges Sep 22 18:22:05 ns600 lfd[931502]: Retrieved and blocking blocklist BITWIRE_INBOUND IP address ranges Sep 22 18:22:05 ns600 lfd[934684]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 18:26:12 ns600 lfd[931502]: Retrieved and blocking blocklist SPAMDROP IP address ranges Sep 22 18:27:06 ns600 lfd[937533]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 18:33:20 ns600 lfd[940189]: Retrieved and blocking blocklist PROJECTHONEYPOT IP address ranges Sep 22 18:35:30 ns600 lfd[940189]: Retrieved and blocking blocklist BRUTEFORCEBLOCKER IP address ranges Sep 22 18:43:36 ns600 lfd[946078]: Retrieved and blocking blocklist GREENSNOW IP address ranges Sep 22 18:46:01 ns600 lfd[946078]: Retrieved and blocking blocklist BDEALL IP address ranges Sep 22 18:47:07 ns600 lfd[949272]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 18:48:27 ns600 lfd[946078]: Retrieved and blocking blocklist BINARYDEFENSE IP address ranges Sep 22 18:53:36 ns600 lfd[952046]: Retrieved and blocking blocklist CIARMY IP address ranges Sep 22 18:56:15 ns600 lfd[952046]: Retrieved and blocking blocklist DSHIELD IP address ranges Sep 22 18:57:08 ns600 lfd[954678]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 19:03:55 ns600 lfd[958543]: Retrieved and blocking blocklist BITWIRE_OUTBOUND IP address ranges Sep 22 19:18:54 ns600 lfd[968374]: Retrieved and blocking blocklist FEODO IP address ranges Sep 22 19:23:46 ns600 lfd[971459]: Retrieved and blocking blocklist INTERSERVER IP address ranges Sep 22 19:26:55 ns600 lfd[971459]: Retrieved and blocking blocklist MERBL IP address ranges Sep 22 19:27:12 ns600 lfd[974209]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 19:28:43 ns600 lfd[971459]: Retrieved and blocking blocklist BITWIRE_INBOUND IP address ranges Sep 22 19:32:13 ns600 lfd[977331]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 19:34:20 ns600 lfd[971459]: Retrieved and blocking blocklist SPAMDROP IP address ranges Sep 22 19:39:10 ns600 lfd[980180]: Retrieved and blocking blocklist PROJECTHONEYPOT IP address ranges Sep 22 19:42:14 ns600 lfd[983177]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 19:42:35 ns600 lfd[980180]: Retrieved and blocking blocklist BRUTEFORCEBLOCKER IP address ranges Sep 22 19:48:42 ns600 lfd[985820]: Retrieved and blocking blocklist GREENSNOW IP address ranges Sep 22 19:52:04 ns600 lfd[985820]: Retrieved and blocking blocklist BDEALL IP address ranges Sep 22 19:52:15 ns600 lfd[989022]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 19:55:28 ns600 lfd[985820]: Retrieved and blocking blocklist BINARYDEFENSE IP address ranges Sep 22 19:58:47 ns600 lfd[992171]: Retrieved and blocking blocklist CIARMY IP address ranges Sep 22 20:01:51 ns600 lfd[992171]: Retrieved and blocking blocklist DSHIELD IP address ranges Sep 22 20:02:17 ns600 lfd[995639]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 20:08:39 ns600 lfd[998530]: Retrieved and blocking blocklist BITWIRE_OUTBOUND IP address ranges Sep 22 20:23:42 ns600 lfd[1008203]: Retrieved and blocking blocklist FEODO IP address ranges Sep 22 20:28:48 ns600 lfd[1011314]: Retrieved and blocking blocklist INTERSERVER IP address ranges Sep 22 20:31:24 ns600 lfd[1011314]: Retrieved and blocking blocklist MERBL IP address ranges Sep 22 20:32:20 ns600 lfd[1014078]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 20:32:54 ns600 lfd[1011314]: Retrieved and blocking blocklist BITWIRE_INBOUND IP address ranges Sep 22 20:37:20 ns600 lfd[1017047]: Unable to retrieve blocklist SPAMDROP for the next 3311 secs Sep 22 20:43:48 ns600 lfd[1019821]: Retrieved and blocking blocklist PROJECTHONEYPOT IP address ranges Sep 22 20:46:36 ns600 lfd[1019821]: Retrieved and blocking blocklist BRUTEFORCEBLOCKER IP address ranges Sep 22 20:47:21 ns600 lfd[1023053]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 20:47:41 ns600 lfd[1019821]: Unable to retrieve blocklist SPAMDROP for the next 2690 secs Sep 22 20:53:37 ns600 lfd[1026078]: Retrieved and blocking blocklist GREENSNOW IP address ranges Sep 22 20:56:10 ns600 lfd[1026078]: Retrieved and blocking blocklist BDEALL IP address ranges Sep 22 20:57:14 ns600 lfd[1026078]: Unable to retrieve blocklist SPAMDROP for the next 2117 secs Sep 22 20:57:22 ns600 lfd[1028727]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 20:58:33 ns600 lfd[1026078]: Retrieved and blocking blocklist BINARYDEFENSE IP address ranges Sep 22 21:02:56 ns600 lfd[1031983]: Unable to retrieve blocklist SPAMDROP for the next 1775 secs Sep 22 21:04:18 ns600 lfd[1031983]: Retrieved and blocking blocklist CIARMY IP address ranges Sep 22 21:07:16 ns600 lfd[1031983]: Retrieved and blocking blocklist DSHIELD IP address ranges Sep 22 21:07:23 ns600 lfd[1035178]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 21:13:42 ns600 lfd[1038292]: Retrieved and blocking blocklist BITWIRE_OUTBOUND IP address ranges Sep 22 21:14:39 ns600 lfd[1038292]: Unable to retrieve blocklist SPAMDROP for the next 1072 secs Sep 22 21:17:24 ns600 lfd[1041931]: Unable to retrieve blocklist SPAMDROP for the next 907 secs Sep 22 21:22:24 ns600 lfd[1045093]: Unable to retrieve blocklist SPAMDROP for the next 607 secs Sep 22 21:28:42 ns600 lfd[1047808]: Retrieved and blocking blocklist FEODO IP address ranges Sep 22 21:29:40 ns600 lfd[1047808]: Unable to retrieve blocklist SPAMDROP for the next 171 secs Sep 22 21:33:50 ns600 lfd[1050885]: Retrieved and blocking blocklist INTERSERVER IP address ranges Sep 22 21:36:40 ns600 lfd[1050885]: Retrieved and blocking blocklist MERBL IP address ranges Sep 22 21:37:26 ns600 lfd[1053653]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 21:38:00 ns600 lfd[1050885]: Retrieved and blocking blocklist BITWIRE_INBOUND IP address ranges Sep 22 21:42:04 ns600 lfd[1050885]: Retrieved and blocking blocklist SPAMDROP IP address ranges Sep 22 21:42:26 ns600 lfd[1056466]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 21:48:43 ns600 lfd[1059137]: Retrieved and blocking blocklist PROJECTHONEYPOT IP address ranges Sep 22 21:51:27 ns600 lfd[1059137]: Retrieved and blocking blocklist BRUTEFORCEBLOCKER IP address ranges Sep 22 21:58:45 ns600 lfd[1064638]: Retrieved and blocking blocklist GREENSNOW IP address ranges Sep 22 22:01:33 ns600 lfd[1064638]: Retrieved and blocking blocklist BDEALL IP address ranges Sep 22 22:02:28 ns600 lfd[1067686]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 22:03:57 ns600 lfd[1064638]: Retrieved and blocking blocklist BINARYDEFENSE IP address ranges Sep 22 22:09:11 ns600 lfd[1070552]: Retrieved and blocking blocklist CIARMY IP address ranges Sep 22 22:11:55 ns600 lfd[1070552]: Retrieved and blocking blocklist DSHIELD IP address ranges Sep 22 22:12:29 ns600 lfd[1073761]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 22:18:43 ns600 lfd[1077580]: Retrieved and blocking blocklist BITWIRE_OUTBOUND IP address ranges Sep 22 22:33:47 ns600 lfd[1086395]: Retrieved and blocking blocklist FEODO IP address ranges Sep 22 22:38:49 ns600 lfd[1088907]: Retrieved and blocking blocklist INTERSERVER IP address ranges Sep 22 22:41:27 ns600 lfd[1088907]: Retrieved and blocking blocklist MERBL IP address ranges Sep 22 22:42:32 ns600 lfd[1091752]: Child : *Lock Error* [BLOCKLISTS] still active - section skipped Sep 22 22:42:45 ns600 lfd[1088907]: Retrieved and blocking blocklist BITWIRE_INBOUND IP address ranges ================================================================ ### IMUNIFY360 / SECURITY PROCESSES ================================================================ root 1093786 6.9 1.2 509548 409520 ? Ssl 22:45 0:05 /opt/rustbolit/rustbolit --resident --with-suspicious --smart --cloud-assist=AUTO --use-heuristics-ignore --deobfuscate --memory=2G --no-html --avdb=/var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --skip-system-owner --skip-imunify360-storage --encode-b64-filenames --scan-archive --hs=/var/imunify360/files/sigs/v1/aibolit/hyperscan root 37507 1.4 0.5 4507092 176372 ? Ssl 00:52 18:25 /usr/bin/imunify-resident root 828 0.4 0.0 2844228 25728 ? Ssl Sep19 22:54 /usr/sbin/wafd_imunify_daemon root 37058 0.3 0.0 2431056 20384 ? Ssl 00:51 4:53 /usr/sbin/imunify-realtime-av root 37425 0.2 0.6 2570784 222840 ? Ssl 00:52 3:08 /usr/sbin/imunify360-php-daemon -idle_timeout 600 root 91379 0.2 0.0 2320244 18420 ? Ssl Sep19 12:37 /usr/sbin/imunify360-unified-access-logger root 168488 0.1 0.1 2232308 40940 ? Ssl 04:20 1:11 /usr/sbin/pam_imunify_daemon.bin root 2667 0.0 0.0 2161980 6216 ? Ssl Sep19 0:06 /usr/sbin/imunify360-webshield-ssl-cache root 2748 0.0 0.0 62504 4832 ? Ss Sep19 0:00 im360: master process /usr/sbin/imunify360-webshield -c /etc/imunify360-webshield/webshield.conf root 38104 0.0 0.0 2130744 9456 ? Ssl 00:53 0:04 /usr/bin/imunify-agent-proxy imunify+ 1304909 0.0 0.0 103636 21048 ? S Sep19 1:57 im360: worker process ================================================================ ### NETWORK SUMMARY ================================================================ Total: 846 TCP: 304 (estab 67, closed 171, orphaned 1, timewait 160) Transport Total IP IPv6 RAW 1 1 0 UDP 9 5 4 TCP 133 115 18 INET 143 121 22 FRAG 0 0 0 ================================================================ ### RECENTLY ACTIVE APACHE DOMAIN LOGS ================================================================ gpv.com.my-ssl_log gpv.com.my-bytes_log greenfeed.com.my-ssl_log greenfeed.com.my-bytes_log natura.com.my-ssl_log natura.com.my-bytes_log barattioman.com-ssl_log btulin.com-ssl_log mutiarafigs.com.my-ssl_log bzbee.com.my-ssl_log gemology.com.my-ssl_log mybgled.com hertztec.com.my-ssl_log astronovaproductid.my shop.mutiarafigs.com.my-bytes_log yourwellnesshealth.com-bytes_log xueda.edu.my-ssl_log xueda.edu.my-bytes_log xueda.edu.my xingdatech.com.my-ssl_log xingdatech.com.my-bytes_log wellspring2u.com.my-ssl_log wellspring2u.com.my-bytes_log wellmach.com.my-ssl_log wellmach.com.my-bytes_log viss.my-ssl_log viss.my-bytes_log urbanwolfadventures.com.my-bytes_log urbanwolfadventures.com.my toyomi.com.my-ssl_log ================================================================ ### TOP PHP-FPM SITES - RECENT REQUEST ANALYSIS ================================================================ ---------------------------------------------------------------- POOL: syntec_com_my | approx domain: syntec.com.my | CPU snapshot: 87.2% ---------------------------------------------------------------- Log: /usr/local/apache/domlogs/syntec.com.my --- Top IPs from latest 3000 requests --- 8 192.82.60.164 --- Top requests from latest 3000 requests --- 1 /.well-known/acme-challenge/_JCSBG8IG3OOFSBWIUQVWAX5-CFYH0-W 1 /.well-known/acme-challenge/W6_NWOEF1EH0RR71ODT4OR15J8-QKWZB 1 /.well-known/acme-challenge/RMWZDIWMLWSM0FUAUV98XUTCDV29F3LJ 1 /.well-known/acme-challenge/RKBOV0DFJ61E4CNYPT0YUXB1X2D4XJS3 1 /.well-known/acme-challenge/QO-4EW7_ACCXGG3-FXCFCWCW6SA7BS2- 1 /.well-known/acme-challenge/EJOKFW1ISGCMB5M7V6__ISTCRPDPEJCA 1 /.well-known/acme-challenge/C024TFLX0NQ7KK60YZNR_I_Y0P9Q9B9U 1 /.well-known/acme-challenge/20RACGOQSWE3MMZYRQXQ24J9Z5JMDEC9 --- Top HTTP statuses --- 8 200 --- Suspicious recent requests --- --- User agents for top 3 source IPs --- IP: 192.82.60.164 8 Cpanel-HTTP-Client/1.0 ---------------------------------------------------------------- POOL: gpv_com_my | approx domain: gpv.com.my | CPU snapshot: 41.8% ---------------------------------------------------------------- Log: /usr/local/apache/domlogs/gpv.com.my --- Top IPs from latest 3000 requests --- 17 203.189.153.19 10 116.105.162.115 6 34.97.27.90 2 192.82.60.164 1 69.63.189.45 1 69.63.189.24 1 69.63.184.22 1 51.254.25.239 1 217.216.38.222 1 136.0.73.76 1 113.211.114.93 1 104.199.113.5 --- Top requests from latest 3000 requests --- 7 / 2 /robots.txt 1 /wp2/wp-includes/wlwmanifest.xml 1 /wp1/wp-includes/wlwmanifest.xml 1 /wp/wp-includes/wlwmanifest.xml 1 /wp-includes/wlwmanifest.xml 1 /wp-admin/css/ 1 /wordpress/wp-includes/wlwmanifest.xml 1 /where-to-buy 1 /website/wp-includes/wlwmanifest.xml 1 /web/wp-includes/wlwmanifest.xml 1 /test/wp-includes/wlwmanifest.xml 1 /static/common/user/uedit/php/controller.php?action=catchimage 1 /sito/wp-includes/wlwmanifest.xml 1 /shop/wp-includes/wlwmanifest.xml 1 /ru/dealers 1 /partners 1 /partneram 1 /news/wp-includes/wlwmanifest.xml 1 /distributors --- Top HTTP statuses --- 22 200 21 301 --- Suspicious recent requests --- 34.97.27.90 - - [22/Sep/2026:21:30:07 +0800] "GET /.env HTTP/1.1" 301 276 "-" "crusader-worker/1.0" 34.97.27.90 - - [22/Sep/2026:21:30:07 +0800] "GET /.env.bak HTTP/1.1" 301 276 "-" "crusader-worker/1.0" 34.97.27.90 - - [22/Sep/2026:21:30:07 +0800] "GET /.env.production HTTP/1.1" 301 276 "-" "crusader-worker/1.0" 34.97.27.90 - - [22/Sep/2026:21:30:07 +0800] "GET /.env.local HTTP/1.1" 301 276 "-" "crusader-worker/1.0" 34.97.27.90 - - [22/Sep/2026:21:30:07 +0800] "GET /.env.old HTTP/1.1" 301 276 "-" "crusader-worker/1.0" 34.97.27.90 - - [22/Sep/2026:21:30:07 +0800] "GET /.env.save HTTP/1.1" 301 276 "-" "crusader-worker/1.0" --- User agents for top 3 source IPs --- IP: 203.189.153.19 17 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 IP: 116.105.162.115 10 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 IP: 34.97.27.90 6 crusader-worker/1.0 ---------------------------------------------------------------- POOL: greenfeed_com_my | approx domain: greenfeed.com.my | CPU snapshot: 26.7% ---------------------------------------------------------------- Log: /usr/local/apache/domlogs/greenfeed.com.my --- Top IPs from latest 3000 requests --- 20 203.189.153.19 18 54.184.226.94 13 35.162.140.124 8 192.82.60.164 2 40.88.21.235 1 8.215.201.250 1 62.210.111.36 1 43.172.73.201 1 43.164.129.191 1 43.159.135.203 1 2a03:2880:10ff:20:: 1 223.109.252.198 1 20.191.45.212 1 103.186.31.45 --- Top requests from latest 3000 requests --- 10 / 1 /wp2/wp-includes/wlwmanifest.xml 1 /wp1/wp-includes/wlwmanifest.xml 1 /wp/wp-includes/wlwmanifest.xml 1 /wp-includes/wlwmanifest.xml 1 /wp-admin/css/ 1 /wordpress/wp-includes/wlwmanifest.xml 1 /website/wp-includes/wlwmanifest.xml 1 /web/wp-includes/wlwmanifest.xml 1 /test/wp-includes/wlwmanifest.xml 1 /sito/wp-includes/wlwmanifest.xml 1 /site/wp-includes/wlwmanifest.xml 1 /shop/wp-includes/wlwmanifest.xml 1 /robots.txt 1 /news/wp-includes/wlwmanifest.xml 1 /media/wp-includes/wlwmanifest.xml 1 /favicon.ico 1 /contact/ 1 /cms/wp-includes/wlwmanifest.xml 1 /blog/wp-includes/wlwmanifest.xml --- Top HTTP statuses --- 38 301 31 200 1 403 --- Suspicious recent requests --- --- User agents for top 3 source IPs --- IP: 203.189.153.19 20 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 IP: 54.184.226.94 18 ManageWP-UptimeMonitoring IP: 35.162.140.124 13 ManageWP-UptimeMonitoring ---------------------------------------------------------------- POOL: toitoi_com_hk | approx domain: toitoi.com.hk | CPU snapshot: 5.5% ---------------------------------------------------------------- Log: /usr/local/apache/domlogs/toitoi.com.hk --- Top IPs from latest 3000 requests --- 2 192.82.60.164 --- Top requests from latest 3000 requests --- 1 /.well-known/acme-challenge/_02B1E41SET6EZ3P6HCYLMZ3ZOVAS3H1 1 /.well-known/acme-challenge/QZWY2O4P9AQJYG6IWMOF1GU0CWNR_B4V --- Top HTTP statuses --- 2 200 --- Suspicious recent requests --- --- User agents for top 3 source IPs --- IP: 192.82.60.164 2 Cpanel-HTTP-Client/1.0 ---------------------------------------------------------------- POOL: compedo_com_my | approx domain: compedo.com.my | CPU snapshot: 1.2% ---------------------------------------------------------------- Log: /usr/local/apache/domlogs/compedo.com.my --- Top IPs from latest 3000 requests --- 20 203.189.153.19 12 34.41.243.107 8 192.82.60.164 3 185.241.211.157 1 35.86.83.21 1 34.212.227.55 1 205.210.31.140 1 195.2.71.225 --- Top requests from latest 3000 requests --- 7 / 2 /wp-admin/css/goods.php 2 /wp-admin/css/admin.php 1 /wp2/wp-includes/wlwmanifest.xml 1 /wp1/wp-includes/wlwmanifest.xml 1 /wp/wp-includes/wlwmanifest.xml 1 /wp-mail.php 1 /wp-includes/wlwmanifest.xml 1 /wp-admin/txets.php 1 /wp-admin/index.php 1 /wp-admin/css/index.php 1 /wp-admin/css/colors/wp-login.php 1 /wp-admin/css/about.php 1 /wp-admin/admin-ajax.php 1 /wordpress/wp-includes/wlwmanifest.xml 1 /website/wp-includes/wlwmanifest.xml 1 /web/wp-includes/wlwmanifest.xml 1 /test/wp-includes/wlwmanifest.xml 1 /sito/wp-includes/wlwmanifest.xml 1 /site/wp-includes/wlwmanifest.xml --- Top HTTP statuses --- 33 200 7 429 5 301 2 404 --- Suspicious recent requests --- 34.41.243.107 - - [22/Sep/2026:21:01:38 +0800] "GET /wp-admin/css/colors/wp-login.php HTTP/1.1" 429 60 "-" "Go-http-client/1.1" 185.241.211.157 - - [22/Sep/2026:22:09:19 +0800] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 200 12207 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 185.241.211.157 - - [22/Sep/2026:22:09:19 +0800] "POST /alfacgiapi/perl.alfa HTTP/1.1" 200 12195 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" --- User agents for top 3 source IPs --- IP: 203.189.153.19 20 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 IP: 34.41.243.107 12 Go-http-client/1.1 IP: 192.82.60.164 8 Cpanel-HTTP-Client/1.0 ---------------------------------------------------------------- POOL: cpanelphpmyadmin | approx domain: cpanelphpmyadmin | CPU snapshot: 0.0% ---------------------------------------------------------------- No matching domlog found for cpanelphpmyadmin ================================================================ ### APACHE QUICK STATUS ================================================================ Apache Server Status for localhost (via ::1) Server Version: Apache/2.4.68 (cPanel) OpenSSL/1.1.1k mod_bwlimited/1.4 Server MPM: event Server Built: Jun 10 2026 15:42:57 -------------------------------------------------------------------------- Current Time: Tuesday, 22-Sep-2026 22:46:46 +08 Restart Time: Saturday, 19-Sep-2026 08:05:10 +08 Parent Server Config. Generation: 71 Parent Server MPM Generation: 70 Server uptime: 3 days 14 hours 41 minutes 35 seconds Server load: 9.50 7.67 6.91 Total accesses: 1401335 - Total Traffic: 30.6 GB - Total Duration: 227827626 CPU Usage: u65.3 s17.09 cu10216.5 cs885.81 - 3.58% CPU load 4.49 requests/sec - 102.7 kB/second - 22.9 kB/request - 162.579 ms/request 5 requests currently being processed, 0 workers gracefully restarting, 145 idle workers +-------------------------------------------------------------------------------------------------------------------+ | | | | Connections | Threads | Async connections | | Slot | PID | Stopping |-------------------+------------------------+------------------------------------------| | | | | total | accepting | busy | graceful | idle | wait-io | writing | keep-alive | closing | |------+---------+----------+-------+-----------+------+----------+------+---------+---------+------------+---------| |0 |1092133 |no |0 |yes |0 |0 |25 |0 |0 |0 |0 | |------+---------+----------+-------+-----------+------+----------+------+---------+---------+------------+---------| |6 |1080278 |no |1 |yes |1 |0 |24 |0 |0 |0 |0 | |------+---------+----------+-------+-----------+------+----------+------+---------+---------+------------+---------| |7 |1080332 |no |0 |yes |0 |0 |25 |0 |0 |0 |0 | |------+---------+----------+-------+-----------+------+----------+------+---------+---------+------------+---------| |8 |1080333 |no |0 |yes |0 |0 |25 |0 |0 |0 |0 | |------+---------+----------+-------+-----------+------+----------+------+---------+---------+------------+---------| |9 |1080334 |no |2 |yes |3 |0 |22 |0 |0 |0 |0 | |------+---------+----------+-------+-----------+------+----------+------+---------+---------+------------+---------| |10 |1080335 |no |1 |yes |1 |0 |24 |0 |0 |0 |0 | |------+---------+----------+-------+-----------+------+----------+------+---------+---------+------------+---------| |Sum |6 |0 |4 | |5 |0 |145 |0 |0 |0 |0 | +-------------------------------------------------------------------------------------------------------------------+ _________________________....................................... ................................................................ ......................__________________R_______________________ ________________________________________W_________R_R_______R___ ___________________......................... Scoreboard Key: "_" Waiting for Connection, "S" Starting up, "R" Reading Request, "W" Sending Reply, "K" Keepalive (read), "D" DNS Lookup, "C" Closing connection, "L" Logging, "G" Gracefully finishing, "I" Idle cleanup of worker, "." Open slot with no current process ================================================================ ### FINAL QUICK SNAPSHOT ================================================================ 22:46:46 up 3 days, 15:21, 1 user, load average: 9.50, 7.67, 6.91 USER PID %CPU %MEM ELAPSED CMD root 1088907 88.1 10.5 09:15 lfd - retrieving blocklist SPAMDROP syntecco 1094469 76.8 0.8 00:05 php-fpm: pool syntec_com_my gpvcom 1094423 38.4 0.8 00:09 php-fpm: pool gpv_com_my greenfee 1089131 26.7 0.6 07:58 php-fpm: pool greenfeed_com_my gpvcom 1094447 26.3 0.6 00:06 php-fpm: pool gpv_com_my greenfee 1089051 26.1 0.6 08:30 php-fpm: pool greenfeed_com_my greenfee 1089098 26.0 0.6 08:19 php-fpm: pool greenfeed_com_my gpvcom 1094452 26.0 0.6 00:06 php-fpm: pool gpv_com_my gpvcom 1094451 25.5 0.6 00:06 php-fpm: pool gpv_com_my gpvcom 1094453 25.3 0.6 00:06 php-fpm: pool gpv_com_my gpvcom 1094454 24.5 0.6 00:06 php-fpm: pool gpv_com_my gpvcom 1094455 23.3 0.5 00:06 php-fpm: pool gpv_com_my gpvcom 1094456 23.3 0.5 00:06 php-fpm: pool gpv_com_my root 1089206 7.4 0.4 07:45 /usr/bin/python3 /usr/local/cpanel/bin/packman_get_list_json all ea-php*-php-common mysql 3018 6.9 15.5 3-15:20:06 /usr/sbin/mysqld root 1093786 6.8 1.2 01:23 /opt/rustbolit/rustbolit --resident --with-suspicious --smart --cloud-assist=AUTO --use-heuristics-ignore --deobfuscate --memory=2G --no-html --avdb=/var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --skip-system-owner --skip-imunify360-storage --encode-b64-filenames --scan-archive --hs=/var/imunify360/files/sigs/v1/aibolit/hyperscan toitoic1 1093939 5.5 0.8 00:54 php-fpm: pool toitoi_com_hk root 1094179 1.5 0.1 00:19 /usr/libexec/platform-python /usr/bin/needs-restarting --reboothint root 37507 1.4 0.5 21:54:15 /usr/bin/imunify-resident ================================================================ Diagnostic complete Saved to: /home/rlocust/public_html/ns600-diagnostic-2026-09-22_22-46-43-qrnpjwga.txt Download filename: ns600-diagnostic-2026-09-22_22-46-43-qrnpjwga.txt NOTE: This report may contain server usernames, IP addresses, paths, and process details. Delete it from public_html after downloading. ================================================================