403WebShell

403Webshell
Server IP : 173.199.190.172 / Your IP : 216.73.216.167
Web Server : Apache
System : Linux chs1.nescrow.com.ng 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64
User : oysipaoygov ( 1026)
PHP Version : 5.6.40
Disable Function : exec,passthru,shell_exec,system
MySQL : ON | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON
Directory : /var/log/loadwatch/
Upload File :
[ Back ]
Current File : /var/log/loadwatch/2025-11-13.01.09.txt
 ## swap threshold exceeded
## server overview
2025-11-13.01.09 load[0] mem[61/69] mysql[1/8] httpd[26]
              total        used        free      shared  buff/cache   available
Mem:           2363        1409         153          15         800         773
Swap:          1999        1539         460
 01:09:02 up  5:06,  0 users,  load average: 0.48, 0.65, 0.66
## system overview
top - 01:09:02 up  5:06,  0 users,  load average: 0.48, 0.65, 0.66
Tasks: 218 total,   6 running, 211 sleeping,   0 stopped,   1 zombie
%Cpu(s): 61.1 us, 30.6 sy,  0.0 ni,  0.0 id,  8.3 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem :  2420300 total,   124424 free,  1460984 used,   834892 buff/cache
KiB Swap:  2047996 total,   472068 free,  1575928 used.   775048 avail Mem 

   PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
  1781 mysql     20   0 1457796 203312   4556 S  50.0  8.4   4:12.59 /usr/sbin+
 32490 root      20   0  169868  16848   2876 S  27.8  0.7   0:00.08 /usr/loca+
 32502 pactpay   20   0  476724  17112  11408 S  11.1  0.7   0:00.02 /opt/cpan+
 32503 nigeria   20   0  400652  15940  10220 S  11.1  0.7   0:00.03 /opt/cpan+
   501 polkitd   20   0  612240    840    560 S   5.6  0.0   0:02.48 /usr/lib/+
 31546 nobody    20   0  277784  17232   3280 S   5.6  0.7   0:00.12 /usr/sbin+
 32523 cloudsms  20   0  295036  15572   9952 R   5.6  0.6   0:00.01 /opt/cpan+
     1 root      20   0   44428   3604   1692 S   0.0  0.1   0:26.19 /usr/lib/+
     2 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [kthreadd]
     4 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kworker/+
     6 root      20   0       0      0      0 S   0.0  0.0   0:01.21 [ksoftirq+
     7 root      rt   0       0      0      0 S   0.0  0.0   0:00.87 [migratio+
     8 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [rcu_bh]
     9 root      20   0       0      0      0 R   0.0  0.0   0:18.64 [rcu_sche+
    10 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [lru-add-+
    11 root      rt   0       0      0      0 S   0.0  0.0   0:00.04 [watchdog+
    12 root      rt   0       0      0      0 S   0.0  0.0   0:00.04 [watchdog+
    13 root      rt   0       0      0      0 S   0.0  0.0   0:00.81 [migratio+
    14 root      20   0       0      0      0 S   0.0  0.0   0:03.43 [ksoftirq+
    16 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kworker/+
    18 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [kdevtmpf+
    19 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [netns]
    20 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [khungtas+
    21 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [writebac+
    22 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kintegri+
    23 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [bioset]
    24 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [bioset]
    25 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [bioset]
    26 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kblockd]
    27 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [md]
    28 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [edac-pol+
    29 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [watchdog+
    36 root      20   0       0      0      0 S   0.0  0.0   0:23.27 [kswapd0]
    37 root      25   5       0      0      0 S   0.0  0.0   0:00.00 [ksmd]
    38 root      39  19       0      0      0 S   0.0  0.0   0:00.02 [khugepag+
    39 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [crypto]
    47 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kthrotld]
    49 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kmpath_r+
    50 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kaluad]
    51 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kpsmouse+
    52 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [ipv6_add+
    65 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [deferwq]
   148 root      20   0       0      0      0 S   0.0  0.0   0:00.40 [kauditd]
   238 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [ata_sff]
   247 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [scsi_eh_+
   248 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [scsi_tmf+
   249 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [scsi_eh_+
   250 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [scsi_tmf+
   256 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [ttm_swap]
   257 root       0 -20       0      0      0 S   0.0  0.0   0:02.22 [kworker/+
   267 root       0 -20       0      0      0 S   0.0  0.0   0:02.11 [kworker/+
   276 root      20   0       0      0      0 S   0.0  0.0   0:00.86 [jbd2/vda+
   277 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [ext4-rsv+
   357 root      20   0   40240   3032   2796 S   0.0  0.1   0:10.70 /usr/lib/+
   382 root      20   0   45360      8      4 S   0.0  0.0   0:00.35 /usr/lib/+
   410 root      16  -4   55532    152     44 S   0.0  0.0   0:01.68 /sbin/aud+
   415 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [rpciod]
   416 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [xprtiod]
   497 root      20   0   24896   1432    800 S   0.0  0.1   0:04.18 /usr/lib/+
   500 root      20   0   21540    348    260 S   0.0  0.0   0:00.40 /usr/sbin+
   503 root      20   0  152780     60     32 S   0.0  0.0   0:00.01 /usr/sbin+
   504 root      20   0  224148   3116    900 S   0.0  0.1   0:00.26 queueproc+
   507 root      20   0   52852    336    248 S   0.0  0.0   0:00.01 /usr/sbin+
   514 dbus      20   0   58728   1316    600 S   0.0  0.1   0:09.45 /usr/bin/+
   519 nscd      20   0 1062080   1304    576 S   0.0  0.1   0:14.88 /usr/sbin+
   521 rpc       20   0   69256      4      0 S   0.0  0.0   0:00.03 /sbin/rpc+
   529 root      20   0    4388      4      0 S   0.0  0.0   0:00.00 /usr/sbin+
   555 root      20   0  195208      0      0 S   0.0  0.0   0:00.00 /usr/sbin+
   575 root      20   0  124480    424    292 S   0.0  0.0   0:00.51 /usr/sbin+
   577 root      20   0   24208      4      0 S   0.0  0.0   0:00.00 /usr/sbin+
   590 root      20   0  114704      0      0 S   0.0  0.0   0:00.02 /bin/bash
   591 root      20   0  108296      8      4 S   0.0  0.0   0:00.00 /sbin/age+
   614 mailnull  20   0   89120   3804    892 S   0.0  0.2   0:00.69 /usr/sbin+
   620 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kvm-irqf+
   665 root       0 -20       0      0      0 S   0.0  0.0   0:02.20 [loop0]
   695 root      20   0       0      0      0 S   0.0  0.0   0:00.02 [jbd2/loo+
   696 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [ext4-rsv+
   924 systuser  20   0  113016     64      0 S   0.0  0.0   0:00.01 /usr/loca+
   928 systuser  20   0   14068      0      0 S   0.0  0.0   0:00.00 /usr/loca+
   929 systuser  20   0  114016  13212   2672 S   0.0  0.5   0:04.52 /usr/loca+
   930 root      20   0  153404    220    140 S   0.0  0.0   0:00.38 pure-ftpd+
   931 root      20   0   51508    460    300 S   0.0  0.0   0:00.26 /usr/sbin+
   932 root      20   0  572372    656    184 S   0.0  0.0   0:01.66 /usr/bin/+
   933 telegraf  20   0 5654048  33664   6004 S   0.0  1.4   0:10.30 /usr/loca+
   935 memcach+  20   0  342400      0      0 S   0.0  0.0   0:00.41 /usr/bin/+
   939 root      20   0  111304    360    260 S   0.0  0.0   0:02.37 /usr/sbin+
   940 systuser  20   0   10132     36      0 S   0.0  0.0   0:00.01 /usr/loca+
   941 systuser  20   0  112268      4      0 S   0.0  0.0   0:00.01 /usr/loca+
   943 root      20   0  445028      0      0 S   0.0  0.0   0:00.05 sw-engine+
   950 root      20   0  386112     96     12 S   0.0  0.0   0:00.57 php-fpm: +
   961 named     20   0  637992  23140   1608 S   0.0  1.0   0:10.23 /usr/sbin+
   964 root      20   0  273744   3052   2668 S   0.0  0.1   0:04.98 /usr/sbin+
   981 root      20   0  436392    400    312 S   0.0  0.0   0:00.67 php-fpm: +
   984 root      20   0  385496    200    112 S   0.0  0.0   0:00.55 php-fpm: +
   985 root      20   0  261288   3700    876 S   0.0  0.2   0:02.82 cpsrvd (S+
   989 root      20   0  392856    216    132 S   0.0  0.0   0:00.54 php-fpm: +
   992 root      20   0 1828184 424692     56 S   0.0 17.5   0:32.13 /usr/loca+
  1000 root      20   0  397344   1872    596 S   0.0  0.1   0:02.48 php-fpm: +
  1006 cpanelc+  20   0   10604   3552   2308 S   0.0  0.1   0:14.99 /usr/loca+
  1075 dovenull  20   0   46984    772    532 S   0.0  0.0   0:00.39 dovecot/p+
  1076 dovenull  20   0   48324   2572   1660 S   0.0  0.1   0:00.33 dovecot/i+
  1077 dovecot   20   0   10320    364    256 S   0.0  0.0   0:00.10 dovecot/a+
  1078 root      20   0   10452    448    284 S   0.0  0.0   0:00.23 dovecot/l+
  1079 dovenull  20   0   46984   1824   1316 S   0.0  0.1   0:00.29 dovecot/p+
  1080 dovenull  20   0   48000   2532   1640 S   0.0  0.1   0:00.24 dovecot/i+
  1084 root      20   0   24396   1864    496 S   0.0  0.1   0:00.13 dovecot/c+
  1088 dovecot   20   0   13568    628    452 S   0.0  0.0   0:00.05 dovecot/s+
  1121 systuser  20   0  157704   2888    960 S   0.0  0.1   0:00.09 SonarPush+
  1166 dovecot   20   0   41260   1536   1008 S   0.0  0.1   0:00.72 dovecot/a+
  1172 root      20   0  248152   3724    688 S   0.0  0.2   0:05.04 /usr/loca+
  1173 wp-tool+  20   0  387556   3528   1660 S   0.0  0.1   0:00.22 /usr/bin/+
  1174 wp-tool+  20   0  410616  18240   1684 S   0.0  0.8   0:15.28 /usr/bin/+
  1232 root      20   0  209372   8288   2008 S   0.0  0.3   0:02.35 tailwatchd
  1234 root      20   0  167452   1200    652 S   0.0  0.0   0:00.34 dnsadmin +
  1237 root      20   0  262224  24624   6760 S   0.0  1.0   0:01.00 cpdavd - +
  1642 root      20   0  299272    504    340 S   0.0  0.0   0:00.49 php-fpm: +
  1702 root      38  18  130416   1340    684 S   0.0  0.1   0:00.05 cpanellog+
  2059 root      20   0  267036   4968    484 S   0.0  0.2   0:01.61 /usr/sbin+
  2063 root      20   0   12788    380    212 S   0.0  0.0   0:02.13 /usr/loca+
  2064 root      20   0   12732    260    180 S   0.0  0.0   0:01.81 /usr/loca+
  2065 root      20   0   12804    388    216 S   0.0  0.0   0:02.00 /usr/loca+
  2089 root      20   0   53268      4      4 S   0.0  0.0   0:00.05 /usr/loca+
  7883 root      20   0  306476  45628   1192 S   0.0  1.9   0:02.66 spamd chi+
  7886 root      20   0  248152   2552    400 S   0.0  0.1   0:00.00 spamd chi+
 12759 root      20   0       0      0      0 S   0.0  0.0   0:00.03 [kworker/+
 16898 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [kworker/+
 16928 root      20   0       0      0      0 S   0.0  0.0   0:00.07 [kworker/+
 17677 root      20   0       0      0      0 S   0.0  0.0   0:00.04 [kworker/+
 20440 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [kworker/+
 23292 root      20   0  183048   2140   1584 S   0.0  0.1   0:00.00 /usr/sbin+
 23359 root      20   0  113284   1212   1032 S   0.0  0.1   0:00.00 /bin/sh -+
 23372 root      20   0  108056    356    284 S   0.0  0.0   0:00.00 sleep 2h +
 23911 root      20   0 1276100  10744    596 S   0.0  0.4   0:00.06 /usr/bin/+
 23946 root      20   0 1277056  11568    596 S   0.0  0.5   0:00.05 /usr/bin/+
 24669 nobody    20   0  277720  17880   3780 S   0.0  0.7   0:00.79 /usr/sbin+
 24735 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [kworker/+
 24771 nobody    20   0  277720  18232   4012 S   0.0  0.8   0:00.77 /usr/sbin+
 25500 worencom  20   0   38380   3668   2872 S   0.0  0.2   0:00.00 dovecot/i+
 25651 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [kworker/+
 25680 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [kworker/+
 26913 nobody    20   0  277656  17736   3732 S   0.0  0.7   0:00.55 /usr/sbin+
 28517 nobody    20   0  277784  18008   3848 S   0.0  0.7   0:00.39 /usr/sbin+
 28978 nobody    20   0  277720  17556   3644 S   0.0  0.7   0:00.38 /usr/sbin+
 29560 nobody    20   0  277720  18068   3816 S   0.0  0.7   0:00.22 /usr/sbin+
 29583 nobody    20   0  277656  17884   3760 S   0.0  0.7   0:00.32 /usr/sbin+
 29584 nobody    20   0  277784  17852   3580 S   0.0  0.7   0:00.32 /usr/sbin+
 29603 nobody    20   0  277784  17876   3708 S   0.0  0.7   0:00.33 /usr/sbin+
 29607 nobody    20   0  277924  17652   3676 S   0.0  0.7   0:00.21 /usr/sbin+
 30633 nobody    20   0  277804  18472   3904 S   0.0  0.8   0:00.15 /usr/sbin+
 30634 nobody    20   0  277784  17756   3668 S   0.0  0.7   0:00.15 /usr/sbin+
 31371 nobody    20   0  277924  17384   3572 S   0.0  0.7   0:00.09 /usr/sbin+
 31378 nobody    20   0  277784  17608   3656 S   0.0  0.7   0:00.07 /usr/sbin+
 31379 nobody    20   0  277784  15776   2140 S   0.0  0.7   0:00.17 /usr/sbin+
 31450 nobody    20   0  277784  17232   3352 S   0.0  0.7   0:00.06 /usr/sbin+
 31466 nobody    20   0  277784  17608   3436 S   0.0  0.7   0:00.07 /usr/sbin+
 31529 root      20   0       0      0      0 S   0.0  0.0   0:00.00 [kworker/+
 31547 nobody    20   0  277664  17696   3688 S   0.0  0.7   0:00.08 /usr/sbin+
 31600 nobody    20   0  277784  17152   3280 S   0.0  0.7   0:00.10 /usr/sbin+
 31601 nobody    20   0  277784  17308   3404 S   0.0  0.7   0:00.09 /usr/sbin+
 31603 nobody    20   0  277784  17544   3640 S   0.0  0.7   0:00.06 /usr/sbin+
 31605 nobody    20   0  277784  16796   3092 S   0.0  0.7   0:00.11 /usr/sbin+
 31683 root      20   0  111304   4272   3252 S   0.0  0.2   0:00.00 sshd: [ac+
 32169 root      20   0   41052   2724   2088 S   0.0  0.1   0:00.00 dovecot/a+
 32318 nobody    20   0  277784  17036   3376 S   0.0  0.7   0:00.01 /usr/sbin+
 32327 nobody    20   0  277932  17068   3380 S   0.0  0.7   0:00.01 /usr/sbin+
 32328 nobody    20   0  277784  16000   2400 S   0.0  0.7   0:00.00 /usr/sbin+
 32376 nobody    20   0  277640  15520   2116 S   0.0  0.6   0:00.00 /usr/sbin+
 32393 nobody    20   0  277640  15520   2116 S   0.0  0.6   0:00.00 /usr/sbin+
 32394 nobody    20   0  277640  15520   2116 S   0.0  0.6   0:00.00 /usr/sbin+
 32405 nigeria   20   0  397064   4472   2348 S   0.0  0.2   0:00.00 php-fpm: +
 32417 nobody    20   0  277640  15520   2116 S   0.0  0.6   0:00.00 /usr/sbin+
 32418 nobody    20   0  277640  15520   2116 S   0.0  0.6   0:00.00 /usr/sbin+
 32419 nobody    20   0  277640  15520   2116 S   0.0  0.6   0:00.00 /usr/sbin+
 32420 nobody    20   0  277640  15524   2120 S   0.0  0.6   0:00.00 /usr/sbin+
 32435 root      20   0       0      0      0 Z   0.0  0.0   0:00.00 [cpaneld +
 32442 root      20   0  183048   2140   1584 S   0.0  0.1   0:00.00 /usr/sbin+
 32444 root      20   0  183048   2144   1588 S   0.0  0.1   0:00.00 /usr/sbin+
 32445 root      20   0  183048   2144   1588 S   0.0  0.1   0:00.00 /usr/sbin+
 32446 root      20   0  183048   2144   1588 S   0.0  0.1   0:00.00 /usr/sbin+
 32447 root      20   0  183048   2144   1588 S   0.0  0.1   0:00.00 /usr/sbin+
 32448 root      20   0  183048   2144   1588 S   0.0  0.1   0:00.00 /usr/sbin+
 32449 root      20   0  183048   2144   1588 S   0.0  0.1   0:00.00 /usr/sbin+
 32450 root      20   0  183048   2144   1588 S   0.0  0.1   0:00.00 /usr/sbin+
 32451 root      20   0  183048   2144   1588 S   0.0  0.1   0:00.00 /usr/sbin+
 32452 root      20   0  183048   2140   1584 S   0.0  0.1   0:00.00 /usr/sbin+
 32453 root      20   0  183048   2144   1588 S   0.0  0.1   0:00.00 /usr/sbin+
 32455 root      20   0  183048   2140   1584 S   0.0  0.1   0:00.00 /usr/sbin+
 32457 root      20   0  113284   1208   1032 S   0.0  0.0   0:00.00 /bin/sh -+
 32458 root      20   0  108052    360    284 S   0.0  0.0   0:00.00 /usr/bin/+
 32459 root      20   0  113288   1516   1300 S   0.0  0.1   0:00.00 /bin/bash+
 32465 cloudw    20   0  352096  15232  10128 S   0.0  0.6   0:00.01 /opt/cpan+
 32475 root      20   0   20164    804    632 S   0.0  0.0   0:00.00 /usr/loca+
 32476 root      20   0   20164    804    632 S   0.0  0.0   0:00.00 /usr/loca+
 32477 root      20   0   20164    808    632 S   0.0  0.0   0:00.00 /usr/loca+
 32478 root      20   0   20164    808    632 S   0.0  0.0   0:00.00 /usr/loca+
 32479 root      20   0   20164    808    632 S   0.0  0.0   0:00.00 /usr/loca+
 32480 root      20   0   20164    988    784 S   0.0  0.0   0:00.00 jailshell+
 32481 root      20   0  113284   1212   1036 S   0.0  0.1   0:00.00 /bin/sh -+
 32482 root      20   0   20164    968    764 S   0.0  0.0   0:00.00 jailshell+
 32483 root      20   0   20164    964    764 S   0.0  0.0   0:00.00 jailshell+
 32484 root      20   0   20164    804    632 S   0.0  0.0   0:00.00 /usr/loca+
 32485 root      20   0   20164    804    632 S   0.0  0.0   0:00.00 /usr/loca+
 32496 pactpay   20   0   20164    256      0 S   0.0  0.0   0:00.00 jailshell+
 32499 nigeria   20   0   20164    264      0 S   0.0  0.0   0:00.00 jailshell+
 32516 root      20   0  160220   2068   1580 R   0.0  0.1   0:00.00 top -bcn1
 32520 root      20   0  113496   1416   1232 S   0.0  0.1   0:00.00 bash /usr+
 32521 root      20   0  154916   5136   2104 R   0.0  0.2   0:00.00 /usr/bin/+
 32522 root      20   0  111304   4268   3252 S   0.0  0.2   0:00.00 sshd: [ac+
 32524 sshd      20   0  115644   2628   1560 S   0.0  0.1   0:00.00 sshd: [ne+
 32525 cloudw    20   0  282524  10384   7264 R   0.0  0.4   0:00.00 /opt/cpan+
 32527 cloudsms  20   0   20164    264      0 S   0.0  0.0   0:00.00 jailshell+
 32528 cloudsms  20   0  113284   1208   1036 S   0.0  0.0   0:00.00 /usr/loca+
 32529 cloudsms  20   0  368196   9972   6992 R   0.0  0.4   0:00.00 /opt/cpan+
 47111 oysipao+  20   0    3148      8      0 S   0.0  0.0   0:00.00 [kworker]
 47116 oysipao+  20   0    3152     36      0 S   0.0  0.0   0:00.28 [kworker]
 76167 root      20   0  181568   6972   1104 S   0.0  0.3   0:04.04 lfd - sle+
 78808 root      20   0       0      0      0 S   0.0  0.0   0:00.01 [kworker/+
 96276 root      20   0       0      0      0 S   0.0  0.0   0:00.20 [kworker/+
USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root          2  0.0  0.0      0     0 ?        S    Nov12   0:00 [kthreadd]
root          4  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [kworker/0:0H]
root          6  0.0  0.0      0     0 ?        S    Nov12   0:01  \_ [ksoftirqd/0]
root          7  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [migration/0]
root          8  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [rcu_bh]
root          9  0.1  0.0      0     0 ?        S    Nov12   0:18  \_ [rcu_sched]
root         10  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [lru-add-drain]
root         11  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [watchdog/0]
root         12  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [watchdog/1]
root         13  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [migration/1]
root         14  0.0  0.0      0     0 ?        R    Nov12   0:03  \_ [ksoftirqd/1]
root         16  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [kworker/1:0H]
root         18  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [kdevtmpfs]
root         19  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [netns]
root         20  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [khungtaskd]
root         21  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [writeback]
root         22  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [kintegrityd]
root         23  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [bioset]
root         24  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [bioset]
root         25  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [bioset]
root         26  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [kblockd]
root         27  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [md]
root         28  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [edac-poller]
root         29  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [watchdogd]
root         36  0.1  0.0      0     0 ?        S    Nov12   0:23  \_ [kswapd0]
root         37  0.0  0.0      0     0 ?        SN   Nov12   0:00  \_ [ksmd]
root         38  0.0  0.0      0     0 ?        SN   Nov12   0:00  \_ [khugepaged]
root         39  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [crypto]
root         47  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [kthrotld]
root         49  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [kmpath_rdacd]
root         50  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [kaluad]
root         51  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [kpsmoused]
root         52  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [ipv6_addrconf]
root         65  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [deferwq]
root        148  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [kauditd]
root        238  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [ata_sff]
root        247  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [scsi_eh_0]
root        248  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [scsi_tmf_0]
root        249  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [scsi_eh_1]
root        250  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [scsi_tmf_1]
root        256  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [ttm_swap]
root        257  0.0  0.0      0     0 ?        S<   Nov12   0:02  \_ [kworker/1:1H]
root        267  0.0  0.0      0     0 ?        S<   Nov12   0:02  \_ [kworker/0:1H]
root        276  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [jbd2/vda3-8]
root        277  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [ext4-rsv-conver]
root        415  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [rpciod]
root        416  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [xprtiod]
root        620  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [kvm-irqfd-clean]
root        665  0.0  0.0      0     0 ?        S<   Nov12   0:02  \_ [loop0]
root        695  0.0  0.0      0     0 ?        S    Nov12   0:00  \_ [jbd2/loop0-8]
root        696  0.0  0.0      0     0 ?        S<   Nov12   0:00  \_ [ext4-rsv-conver]
root      78808  0.0  0.0      0     0 ?        S    00:03   0:00  \_ [kworker/0:3]
root      96276  0.0  0.0      0     0 ?        S    00:25   0:00  \_ [kworker/u200:0]
root      12759  0.0  0.0      0     0 ?        S    00:48   0:00  \_ [kworker/1:3]
root      16898  0.0  0.0      0     0 ?        S    00:53   0:00  \_ [kworker/0:1]
root      16928  0.0  0.0      0     0 ?        S    00:53   0:00  \_ [kworker/1:2]
root      17677  0.0  0.0      0     0 ?        S    00:54   0:00  \_ [kworker/1:4]
root      20440  0.0  0.0      0     0 ?        S    00:57   0:00  \_ [kworker/u200:1]
root      24735  0.0  0.0      0     0 ?        S    01:01   0:00  \_ [kworker/0:4]
root      25651  0.0  0.0      0     0 ?        S    01:02   0:00  \_ [kworker/0:5]
root      25680  0.0  0.0      0     0 ?        S    01:02   0:00  \_ [kworker/1:0]
root      31529  0.0  0.0      0     0 ?        S    01:08   0:00  \_ [kworker/1:1]
root          1  0.1  0.1  44428  3604 ?        Ss   Nov12   0:26 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
root        357  0.0  0.1  40240  3032 ?        Ss   Nov12   0:10 /usr/lib/systemd/systemd-journald
root        382  0.0  0.0  45360     8 ?        Ss   Nov12   0:00 /usr/lib/systemd/systemd-udevd
root        410  0.0  0.0  55532   152 ?        S<sl Nov12   0:01 /sbin/auditd
root        497  0.0  0.0  24896  1432 ?        Ss   Nov12   0:04 /usr/lib/systemd/systemd-logind
root        500  0.0  0.0  21540   348 ?        Ss   Nov12   0:00 /usr/sbin/irqbalance --foreground
polkitd     501  0.0  0.0 612240   840 ?        Ssl  Nov12   0:02 /usr/lib/polkit-1/polkitd --no-debug
root        503  0.0  0.0 152780    60 ?        Ss   Nov12   0:00 /usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/local/cpanel/bin/pureauth
root        504  0.0  0.1 224148  3116 ?        Ss   Nov12   0:00 queueprocd - waiting up to 60s to process a task
root        507  0.0  0.0  52852   336 ?        Ss   Nov12   0:00 /usr/sbin/smartd -n -q never
dbus        514  0.0  0.0  58728  1316 ?        Ss   Nov12   0:09 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
nscd        519  0.0  0.0 1062080 1304 ?        Ssl  Nov12   0:14 /usr/sbin/nscd
rpc         521  0.0  0.0  69256     4 ?        Ss   Nov12   0:00 /sbin/rpcbind -w
root        529  0.0  0.0   4388     4 ?        Ss   Nov12   0:00 /usr/sbin/acpid
root        555  0.0  0.0 195208     0 ?        Ssl  Nov12   0:00 /usr/sbin/gssproxy -D
root        575  0.0  0.0 124480   424 ?        Ss   Nov12   0:00 /usr/sbin/crond -n
root      23292  0.0  0.0 183048  2140 ?        S    01:00   0:00  \_ /usr/sbin/CROND -n
root      23359  0.0  0.0 113284  1212 ?        Ss   01:00   0:00  |   \_ /bin/sh -c sleep $((1 + RANDOM % 5))h $((1 + RANDOM % 60))m; /usr/local/bin/wp-toolkit update-configuration > /dev/null 2> /dev/null || /usr/local/cpanel/3rdparty/wp-toolkit/bin/wp-toolkit-installer.sh --generate-configs > /dev/null 2> /dev/null; /usr/bin/yum -y update wp-toolkit-cpanel > /dev/null 2> /dev/null
root      23372  0.0  0.0 108056   356 ?        S    01:00   0:00  |       \_ sleep 2h 2m
root      32442  0.0  0.0 183048  2140 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32457  0.0  0.0 113284  1208 ?        Ss   01:09   0:00  |   \_ /bin/sh -c /usr/bin/flock -n /dev/shm/loadwatch.lock -c /usr/local/lp/bin/loadwatch &> /dev/null
root      32458  0.0  0.0 108052   360 ?        S    01:09   0:00  |       \_ /usr/bin/flock -n /dev/shm/loadwatch.lock -c /usr/local/lp/bin/loadwatch
root      32459  0.0  0.0 113288  1516 ?        S    01:09   0:00  |           \_ /bin/bash /usr/local/lp/bin/loadwatch
root      32530  0.0  0.0 153840  2096 ?        R    01:09   0:00  |               \_ ps auxf
root      32444  0.0  0.0 183048  2144 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32477  0.0  0.0  20164   808 ?        Ss   01:09   0:00  |   \_ /usr/local/cpanel/bin/jailshell -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/cron/process_schedules.php > /dev/null 2>&1
root      32445  0.0  0.0 183048  2144 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32485  0.0  0.0  20164   804 ?        Ss   01:09   0:00  |   \_ /usr/local/cpanel/bin/jailshell -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/cron/process_queue2.php > /dev/null 2>&1
root      32446  0.0  0.0 183048  2144 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32484  0.0  0.0  20164   804 ?        Ss   01:09   0:00  |   \_ /usr/local/cpanel/bin/jailshell -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/massmailer/cron.php > /dev/null 2>&1
root      32447  0.0  0.0 183048  2144 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32476  0.0  0.0  20164   804 ?        Ss   01:09   0:00  |   \_ /usr/local/cpanel/bin/jailshell -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/cron/process_queue.php > /dev/null 2>&1
root      32448  0.0  0.0 183048  2144 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32479  0.0  0.0  20164   808 ?        Ss   01:09   0:00  |   \_ /usr/local/cpanel/bin/jailshell -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/cron/process_queue5.php > /dev/null 2>&1
root      32449  0.0  0.0 183048  2144 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32478  0.0  0.0  20164   808 ?        Ss   01:09   0:00  |   \_ /usr/local/cpanel/bin/jailshell -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/cron/process_queue4.php > /dev/null 2>&1
root      32450  0.0  0.0 183048  2144 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32475  0.0  0.0  20164   804 ?        Ss   01:09   0:00  |   \_ /usr/local/cpanel/bin/jailshell -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/cron/process_queue3.php > /dev/null 2>&1
root      32451  0.0  0.0 183048  2144 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32480  0.0  0.0  20164   988 ?        Ss   01:09   0:00  |   \_ jailshell (cloudsms) [32527] ll -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/cron/process_queue1.php > /dev/null 2>&1
cloudsms  32527  0.0  0.0  20164   264 ?        S    01:09   0:00  |       \_ jailshell (cloudsms) [init] ell -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/cron/process_queue1.php > /dev/null 2>&1
cloudsms  32528  0.0  0.0 113284  1208 ?        S    01:09   0:00  |           \_ /usr/local/cpanel/bin/jailshell -c cd /home/cloudsms/public_html/cron/ ; php -q -f /home/cloudsms/public_html/cron/process_queue1.php > /dev/null 2>&1
cloudsms  32529  0.0  0.6 400652 15672 ?        R    01:09   0:00  |               \_ /opt/cpanel/ea-php74/root/usr/bin/php-cgi -q -f /home/cloudsms/public_html/cron/process_queue1.php
root      32452  0.0  0.0 183048  2140 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32481  0.0  0.0 113284  1212 ?        Ss   01:09   0:00  |   \_ /bin/sh -c /usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1
root      32490  0.0  0.6 169868 16848 ?        S    01:09   0:00  |       \_ /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/clean_user_php_sessions
root      32520  0.0  0.0 113496  1416 ?        S    01:09   0:00  |           \_ bash /usr/local/cpanel/bin/python-packman /usr/local/cpanel/bin/packman_get_list_json all ea-php*-php-common
root      32521  0.0  0.2 176856  6016 ?        R    01:09   0:00  |               \_ /usr/bin/python2.7 -c import yum
root      32453  0.0  0.0 183048  2144 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32483  0.0  0.0  20164   964 ?        Ss   01:09   0:00  |   \_ jailshell (pactpay) [32496] ell -c php -q -f /home/pactpay/public_html/secure/cron/currency_rate.php
pactpay   32496  0.0  0.0  20164   256 ?        S    01:09   0:00  |       \_ jailshell (pactpay) [init] hell -c php -q -f /home/pactpay/public_html/secure/cron/currency_rate.php
pactpay   32502  0.0  0.7 476724 17112 ?        R    01:09   0:00  |           \_ /opt/cpanel/ea-php74/root/usr/bin/php-cgi -q -f /home/pactpay/public_html/secure/cron/currency_rate.php
root      32455  0.0  0.0 183048  2140 ?        S    01:09   0:00  \_ /usr/sbin/CROND -n
root      32482  0.0  0.0  20164   968 ?        Ss   01:09   0:00      \_ jailshell (nigeria) [32499] ell -c php -q -f /home/nigeria/public_html/crons/analyzer.php
nigeria   32499  0.0  0.0  20164   264 ?        S    01:09   0:00          \_ jailshell (nigeria) [init] hell -c php -q -f /home/nigeria/public_html/crons/analyzer.php
nigeria   32503  0.0  0.6 400652 15940 ?        S    01:09   0:00              \_ /opt/cpanel/ea-php74/root/usr/bin/php-cgi -q -f /home/nigeria/public_html/crons/analyzer.php
root        577  0.0  0.0  24208     4 ?        Ss   Nov12   0:00 /usr/sbin/atd -f
root        590  0.0  0.0 114704     0 ttyS0    Ss+  Nov12   0:00 /bin/bash
root        591  0.0  0.0 108296     8 tty1     Ss+  Nov12   0:00 /sbin/agetty --noclear tty1 linux
mailnull    614  0.0  0.1  89120  3804 ?        Ss   Nov12   0:00 /usr/sbin/exim -ps -bd -q60m -oP /var/spool/exim/exim-daemon.pid
systuser    924  0.0  0.0 113016    64 ?        Ssl  Nov12   0:00 /usr/local/lp/opt/exporters/php-fpm_exporter/php-fpm_exporter server
systuser    928  0.0  0.0  14068     0 ?        Ssl  Nov12   0:00 /usr/local/lp/opt/exporters/mysqld_exporter/mysqld_exporter --config.my-cnf=/usr/local/lp/etc/exporters/my.cnf
systuser    929  0.0  0.5 114016 13212 ?        Ssl  Nov12   0:04 /usr/local/lp/opt/exporters/blackbox_exporter/blackbox_exporter --config.file /usr/local/lp/etc/exporters/blackbox.yml
root        930  0.0  0.0 153404   220 ?        Ss   Nov12   0:00 pure-ftpd (SERVER)
root        931  0.0  0.0  51508   460 ?        Ss   Nov12   0:00 /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf
dovenull   1075  0.0  0.0  46984   772 ?        S    Nov12   0:00  \_ dovecot/pop3-login
dovenull   1076  0.0  0.1  48324  2572 ?        S    Nov12   0:00  \_ dovecot/imap-login
dovecot    1077  0.0  0.0  10320   364 ?        S    Nov12   0:00  \_ dovecot/anvil
root       1078  0.0  0.0  10452   448 ?        S    Nov12   0:00  \_ dovecot/log
dovenull   1079  0.0  0.0  46984  1824 ?        S    Nov12   0:00  \_ dovecot/pop3-login
dovenull   1080  0.0  0.1  48000  2532 ?        S    Nov12   0:00  \_ dovecot/imap-login
root       1084  0.0  0.0  24396  1864 ?        S    Nov12   0:00  \_ dovecot/config
dovecot    1088  0.0  0.0  13568   628 ?        S    Nov12   0:00  \_ dovecot/stats
dovecot    1166  0.0  0.0  41260  1536 ?        S    Nov12   0:00  \_ dovecot/auth
worencom  25500  0.0  0.1  38380  3668 ?        S    01:01   0:00  \_ dovecot/imap
root      32169  0.0  0.1  41052  2724 ?        S    01:08   0:00  \_ dovecot/auth -w
root        932  0.0  0.0 572372   656 ?        Ssl  Nov12   0:01 /usr/bin/python2 -Es /usr/sbin/tuned -l -P
telegraf    933  0.0  1.3 5654048 33664 ?       SLsl Nov12   0:10 /usr/local/lp/bin/telegraf -config /usr/local/lp/etc/telegraf.toml -config-directory /usr/local/lp/etc/telegraf.d
memcach+    935  0.0  0.0 342400     0 ?        Ssl  Nov12   0:00 /usr/bin/memcached -u memcached -p 11211 -m 64 -c 1024
root        939  0.0  0.0 111304   360 ?        Ss   Nov12   0:02 /usr/sbin/sshd -D
root      31683  0.0  0.1 111304  4272 ?        Ss   01:08   0:00  \_ sshd: [accepted]
root      32522  0.0  0.1 111304  4268 ?        Ss   01:09   0:00  \_ sshd: [accepted]
sshd      32524  0.0  0.1 115644  2628 ?        S    01:09   0:00      \_ sshd: [net]
systuser    940  0.0  0.0  10132    36 ?        Ssl  Nov12   0:00 /usr/local/lp/opt/exporters/apache_exporter/apache_exporter
systuser    941  0.0  0.0 112268     4 ?        Ssl  Nov12   0:00 /usr/local/lp/opt/exporters/node_exporter/node_exporter
root        943  0.0  0.0 445028     0 ?        Ss   Nov12   0:00 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf)
root        950  0.0  0.0 386112    96 ?        Ss   Nov12   0:00 php-fpm: master process (/opt/cpanel/ea-php70/root/etc/php-fpm.conf)
named       961  0.0  0.9 637992 23140 ?        Ssl  Nov12   0:10 /usr/sbin/pdns_server --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no
root        964  0.0  0.1 273744  3052 ?        Ssl  Nov12   0:04 /usr/sbin/rsyslogd -n
root        981  0.0  0.0 436392   400 ?        Ss   Nov12   0:00 php-fpm: master process (/opt/cpanel/ea-php56/root/etc/php-fpm.conf)
root        984  0.0  0.0 385496   200 ?        Ss   Nov12   0:00 php-fpm: master process (/opt/cpanel/ea-php73/root/etc/php-fpm.conf)
root        985  0.0  0.1 261288  3700 ?        Ss   Nov12   0:02 cpsrvd (SSL) - waiting for connections                   
root      32435  0.0  0.0      0     0 ?        Z    01:09   0:00  \_ [cpaneld - servi] <defunct>
root        989  0.0  0.0 392856   216 ?        Ss   Nov12   0:00 php-fpm: master process (/opt/cpanel/ea-php81/root/etc/php-fpm.conf)
root        992  0.1 17.5 1828184 424692 ?      Ssl  Nov12   0:32 /usr/local/cpanel/3rdparty/bin/clamd -F
root       1000  0.0  0.0 397344  1872 ?        Ss   Nov12   0:02 php-fpm: master process (/opt/cpanel/ea-php74/root/etc/php-fpm.conf)
nigeria   32405  0.0  0.1 397064  4472 ?        S    01:08   0:00  \_ php-fpm: pool nigeriadecide_org
cpanelc+   1006  0.0  0.1  10604  3552 ?        Ss   Nov12   0:14 /usr/local/cpanel/3rdparty/sbin/p0f -i any -u cpanelconnecttrack -d -s /var/cpanel/userhomes/cpanelconnecttrack/p0f.socket less 400 and not dst port 80 and not dst port 443 and tcp[13] & 8==0
systuser   1121  0.0  0.1 157704  2888 ?        S    Nov12   0:00 SonarPush 0.6.12 [sleeping]
root       1172  0.0  0.1 248152  3724 ?        Ss   Nov12   0:05 /usr/local/cpanel/3rdparty/perl/536/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 --pidfile=/var/run/spamd.pid --listen=5 --listen=6
root       7883  0.0  1.8 306476 45628 ?        S    Nov12   0:02  \_ spamd child
root       7886  0.0  0.1 248152  2552 ?        S    Nov12   0:00  \_ spamd child
wp-tool+   1173  0.0  0.1 387556  3528 ?        Ss   Nov12   0:00 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php
wp-tool+   1174  0.0  0.7 410616 18240 ?        Ss   Nov12   0:15 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php
root       1232  0.0  0.3 209372  8288 ?        Ss   Nov12   0:02 tailwatchd
root       1234  0.0  0.0 167452  1200 ?        Ss   Nov12   0:00 dnsadmin - dormant mode
root       1237  0.0  1.0 262224 24624 ?        Ss   Nov12   0:01 cpdavd - accepting connections on: 2091, 2077, 2078
root       1642  0.0  0.0 299272   504 ?        Ss   Nov12   0:00 php-fpm: master process (/usr/local/cpanel/etc/php-fpm.conf)
root       1702  0.0  0.0 130416  1340 ?        SN   Nov12   0:00 cpanellogd - sleeping for logs
mysql      1781  1.3  8.4 1457796 203312 ?      Sl   Nov12   4:12 /usr/sbin/mysqld --daemonize --pid-file=/var/run/mysqld/mysqld.pid
root       2059  0.0  0.2 267036  4968 ?        Ss   Nov12   0:01 /usr/sbin/httpd -k start
root       2063  0.0  0.0  12788   380 ?        S    Nov12   0:02  \_ /usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=chs1.nescrow.com.ng --suffix=-bytes_log
root       2064  0.0  0.0  12732   260 ?        S    Nov12   0:01  \_ /usr/local/cpanel/bin/splitlogs --main=apache-traffic.log --mainout=/var/log/cpanel-server-traffic/web/traffic-apache.log
root       2065  0.0  0.0  12804   388 ?        S    Nov12   0:02  \_ /usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=chs1.nescrow.com.ng --mainout=/etc/apache2/logs/access_log
root       2089  0.0  0.0  53268     4 ?        S    Nov12   0:00  \_ /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/bin/leechprotect
nobody    24669  0.1  0.7 277720 17880 ?        S    01:01   0:00  \_ /usr/sbin/httpd -k start
nobody    24771  0.1  0.7 277720 18232 ?        S    01:01   0:00  \_ /usr/sbin/httpd -k start
nobody    26913  0.1  0.7 277656 17736 ?        S    01:03   0:00  \_ /usr/sbin/httpd -k start
nobody    28517  0.1  0.7 277784 18008 ?        S    01:04   0:00  \_ /usr/sbin/httpd -k start
nobody    28978  0.1  0.7 277720 17556 ?        S    01:05   0:00  \_ /usr/sbin/httpd -k start
nobody    29560  0.1  0.7 277720 18068 ?        S    01:05   0:00  \_ /usr/sbin/httpd -k start
nobody    29583  0.1  0.7 277656 17884 ?        S    01:05   0:00  \_ /usr/sbin/httpd -k start
nobody    29584  0.1  0.7 277784 17852 ?        S    01:05   0:00  \_ /usr/sbin/httpd -k start
nobody    29603  0.1  0.7 277784 17876 ?        S    01:06   0:00  \_ /usr/sbin/httpd -k start
nobody    29607  0.1  0.7 277924 17652 ?        S    01:06   0:00  \_ /usr/sbin/httpd -k start
nobody    30633  0.1  0.7 277804 18472 ?        S    01:07   0:00  \_ /usr/sbin/httpd -k start
nobody    30634  0.1  0.7 277784 17756 ?        R    01:07   0:00  \_ /usr/sbin/httpd -k start
cloudw    32465  0.0  0.6 352096 15752 ?        R    01:09   0:00  |   \_ /opt/cpanel/ea-php70/root/usr/bin/php-cgi
nobody    31371  0.1  0.7 277924 17384 ?        S    01:07   0:00  \_ /usr/sbin/httpd -k start
nobody    31378  0.1  0.7 277784 17608 ?        S    01:07   0:00  \_ /usr/sbin/httpd -k start
nobody    31379  0.2  0.6 277784 15776 ?        S    01:07   0:00  \_ /usr/sbin/httpd -k start
nobody    31450  0.0  0.7 277784 17232 ?        S    01:07   0:00  \_ /usr/sbin/httpd -k start
nobody    31466  0.1  0.7 277784 17608 ?        S    01:07   0:00  \_ /usr/sbin/httpd -k start
nobody    31546  0.1  0.7 277784 17232 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
cloudw    32525  0.0  0.4 282524 10384 ?        R    01:09   0:00  |   \_ /opt/cpanel/ea-php70/root/usr/bin/php-cgi
nobody    31547  0.1  0.7 277664 17696 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    31600  0.1  0.7 277784 17152 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    31601  0.1  0.7 277784 17308 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    31603  0.1  0.7 277784 17544 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    31605  0.1  0.6 277784 16796 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32318  0.1  0.7 277784 17036 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32327  0.1  0.7 277932 17068 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32328  0.0  0.6 277784 16000 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32376  0.0  0.6 277640 15520 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32393  0.0  0.6 277640 15520 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32394  0.0  0.6 277640 15520 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32417  0.0  0.6 277640 15520 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32418  0.0  0.6 277640 15520 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32419  0.0  0.6 277640 15520 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
nobody    32420  0.0  0.6 277640 15524 ?        S    01:08   0:00  \_ /usr/sbin/httpd -k start
oysipao+  47111  0.0  0.0   3148     8 ?        Ss   Nov12   0:00 [kworker]
oysipao+  47116  0.0  0.0   3152    36 ?        S    Nov12   0:00  \_ [kworker]
root      76167  0.0  0.2 181568  6972 ?        Ss   00:00   0:04 lfd - sleeping
root      23911  0.0  0.4 1276100 10744 ?       Ssl  01:00   0:00 /usr/bin/cspdaemon
root      23946  0.0  0.4 1277056 11568 ?       Ssl  01:00   0:00 /usr/bin/checkstatus
## mysql stats
Uptime: 18363  Threads: 3  Questions: 1524824  Slow queries: 0  Opens: 6009  Flush tables: 1  Open tables: 2000  Queries per second avg: 83.037
*************************** 1. row ***************************
     Id: 21567
   User: pactpay_testing1
   Host: localhost
     db: pactpay_real
Command: Query
   Time: 0
  State: Sending data
   Info: SELECT `id` FROM `currency_rate` WHERE `day`='2025-11-13' LIMIT 1
*************************** 2. row ***************************
     Id: 21568
   User: nigeria_decide
   Host: localhost
     db: nigeria_decide
Command: Sleep
   Time: 0
  State: 
   Info: NULL
*************************** 3. row ***************************
     Id: 21575
   User: root
   Host: localhost
     db: NULL
Command: Query
   Time: 0
  State: starting
   Info: show processlist
## network stats
      1 114.119.128.35 TIME_WAIT
      1 114.119.132.202 TIME_WAIT
      1 114.119.134.212 TIME_WAIT
      1 152.232.146.229 TIME_WAIT
      1 166.0.254.34 TIME_WAIT
      1 167.114.139.232 TIME_WAIT
      1 192.178.4.101 TIME_WAIT
      1 192.178.4.98 TIME_WAIT
      1 ::1 TIME_WAIT
      1 207.46.13.51 TIME_WAIT
      1 45.251.112.73 TIME_WAIT
      1 51.222.95.41 TIME_WAIT
      1 66.249.64.102 TIME_WAIT
      1 66.249.64.76 TIME_WAIT
      1 66.249.70.199 TIME_WAIT
      1 66.249.70.2 TIME_WAIT
      2 10.30.9.122 TIME_WAIT
      2 10.30.9.138 TIME_WAIT
      2 127.0.0.1 TIME_WAIT
      2 66.249.70.197 TIME_WAIT
## httpd stats
                                                                                                                                                                                  Apache Server Status for localhost (via ::1)

   Server Version: Apache/2.4.65 (cPanel) OpenSSL/1.1.1w mod_bwlimited/1.4
   Server MPM: prefork
   Server Built: Oct 28 2025 23:52:55
     __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

   Current Time: Thursday, 13-Nov-2025 01:09:02 WAT
   Restart Time: Wednesday, 12-Nov-2025 20:03:03 WAT
   Parent Server Config. Generation: 1
   Parent Server MPM Generation: 0
   Server uptime: 5 hours 5 minutes 58 seconds
   Server load: 0.48 0.65 0.66
   Total accesses: 94607 - Total Traffic: 2.5 GB - Total Duration: 47259587
   CPU Usage: u4.21 s3.02 cu1218.57 cs972.35 - 12% CPU load
   5.15 requests/sec - 145.0 kB/second - 28.1 kB/request - 499.536 ms/request
   25 requests currently being processed, 0 workers gracefully restarting, 8 idle workers

KK___KKKKKKK_KKK_WKWKK._.K._K.W.KKKK._.K........................
................................................................
................................................................
................................................................

   Scoreboard Key:
   "_" Waiting for Connection, "S" Starting up, "R" Reading Request,
   "W" Sending Reply, "K" Keepalive (read), "D" DNS Lookup,
   "C" Closing connection, "L" Logging, "G" Gracefully finishing,
   "I" Idle cleanup of worker, "." Open slot with no current process

   Srv   PID     Acc     M CPU   SS   Req   Dur   Conn Child  Slot      Client      Protocol              VHost                                          Request
   0-0  32318 1/3/4681   K 0.02 2     299 2314019 32.3 0.07  118.95 66.249.70.66    http/1.1 schoolplus.cloudware.ng:80      GET /?p=3329199356 HTTP/1.1
   1-0  32327 1/3/4660   K 0.03 1     361 2140819 30.4 0.07  113.55 66.249.64.15    http/1.1 schoolplus.cloudware.ng:80      GET /?p=2351585324 HTTP/1.1
   2-0  29560 0/46/4522  _ 0.82 0     310 2348564 0.0  1.40  134.17 192.178.4.99    http/1.1 schoolplus.cloudware.ng:80      GET /?p=3590852004 HTTP/1.1
   3-0  32328 0/3/4642   _ 0.01 0     0   2445370 0.0  0.05  137.02 ::1             http/1.1 chs1.nescrow.com.ng:80          GET //whm-server-status HTTP/1.0
   4-0  32376 0/1/4417   _ 0.00 0     255 2149643 0.0  0.03  114.61 66.249.64.68    http/1.1 schoolplus.cloudware.ng:80      GET /?p=1315520396 HTTP/1.1
   5-0  32393 1/1/4615   K 0.00 3     312 2359750 31.5 0.03  147.49 66.249.70.161   http/1.1 schoolplus.cloudware.ng:80      GET /?p=3772101 HTTP/1.1
   6-0  32394 1/1/4336   K 0.00 3     277 2187161 30.7 0.03  116.87 66.249.70.105   http/1.1 schoolplus.cloudware.ng:80      GET /?p=3372422589 HTTP/1.1
   7-0  30633 1/29/5062  K 0.52 4     262 2354079 29.2 0.87  135.13 66.249.64.103   http/1.1 schoolplus.cloudware.ng:80      GET /?p=996868139 HTTP/1.1
   8-0  30634 1/27/3851  K 0.65 0     350 1952940 30.8 0.71  100.08 66.249.64.174   http/1.1 schoolplus.cloudware.ng:80      GET /?p=1818381887 HTTP/1.1
   9-0  31371 2/16/4050  K 0.39 1     271 2046866 60.3 0.44  109.06 66.249.64.73    http/1.1 schoolplus.cloudware.ng:80      GET /?p=1409499908 HTTP/1.1
   10-0 32417 1/1/4198   K 0.00 2     320 2028261 32.1 0.03  117.70 66.249.70.65    http/1.1 schoolplus.cloudware.ng:80      GET /?p=1721675840 HTTP/1.1
   11-0 32418 1/1/4479   K 0.00 1     309 2270239 31.7 0.03  146.92 66.249.70.174   http/1.1 schoolplus.cloudware.ng:80      GET /?p=3798777926 HTTP/1.1
   12-0 24669 0/131/4035 _ 3.52 0     266 1943977 0.0  4.03  101.68 66.249.64.106   http/1.1 schoolplus.cloudware.ng:80      GET /?p=1697110047 HTTP/1.1
   13-0 29583 1/55/3296  K 1.39 0     357 1521165 30.3 1.90  78.25  66.249.70.194   http/1.1 schoolplus.cloudware.ng:80      GET /?p=3627388517 HTTP/1.1
   14-0 29584 1/56/3460  K 1.42 0     392 1774519 30.7 1.52  107.27 66.249.70.7     http/1.1 schoolplus.cloudware.ng:80      GET /?p=2629041101 HTTP/1.1
   15-0 32419 1/1/2815   K 0.00 1     288 1399220 31.3 0.03  72.43  66.249.70.165   http/1.1 schoolplus.cloudware.ng:80      GET /?p=4220908633 HTTP/1.1
   16-0 31378 0/15/4111  _ 0.23 0     331 2019783 0.0  0.29  110.53 66.249.70.37    http/1.1 schoolplus.cloudware.ng:80      GET /?p=3670470451 HTTP/1.1
   17-0 28517 0/68/4722  W 1.77 0     0   2423562 0.0  1.86  139.23 ::1             http/1.1 chs1.nescrow.com.ng:80          GET //whm-server-status HTTP/1.0
   18-0 32420 1/1/2065   K 0.00 2     267 1126675 30.5 0.03  56.75  66.249.64.130   http/1.1 schoolplus.cloudware.ng:80      GET /?p=3752698046 HTTP/1.1
   19-0 31379 0/28/2703  W 0.79 0     0   1425547 0.0  0.84  75.09  66.249.70.2     http/1.1 schoolplus.cloudware.ng:80      GET /?p=2530460080 HTTP/1.1
   20-0 29603 1/57/1468  K 1.52 2     327 772175  30.5 1.58  37.99  66.249.70.65    http/1.1 schoolplus.cloudware.ng:80      GET /?p=2486022142 HTTP/1.1
   21-0 28978 13/69/1555 K 1.92 0     57  824883  90.8 1.87  44.93  147.135.215.173 http/1.1 cloudsms.com.ng:443             GET /welcome.php/recharge/recharge/recharge/recharge/SendToAll/
   22-0 -     0/0/1655   . 0.00 50    0   889723  0.0  0.00  54.01  ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   23-0 31450 0/12/1065  _ 0.19 0     273 534189  0.0  0.33  25.02  66.249.70.36    http/1.1 schoolplus.cloudware.ng:80      GET /?p=3291135030 HTTP/1.1
   24-0 -     0/0/2016   . 0.00 44    0   806494  0.0  0.00  44.13  ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   25-0 31466 1/15/964   K 0.24 3     275 499621  29.1 0.30  26.61  66.249.64.1     http/1.1 schoolplus.cloudware.ng:80      GET /?p=2004621142 HTTP/1.1
   26-0 -     0/0/426    . 0.00 52    0   231867  0.0  0.00  11.43  ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   27-0 29607 0/63/490   _ 1.58 0     298 246914  0.0  0.66  13.24  66.249.70.68    http/1.1 schoolplus.cloudware.ng:80      GET /?p=3755747975 HTTP/1.1
   28-0 24771 1/135/1392 K 3.69 3     285 611353  29.6 3.77  32.21  66.249.64.75    http/1.1 schoolplus.cloudware.ng:80      GET /?p=1674558957 HTTP/1.1
   29-0 -     0/0/303    . 0.00 51    0   177690  0.0  0.00  8.09   ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   30-0 31546 0/20/635   W 0.52 0     0   324122  0.0  0.55  14.79  66.249.70.162   http/1.1 schoolplus.cloudware.ng:80      GET /?p=2072021091 HTTP/1.1
   31-0 -     0/0/247    . 0.00 24    0   140137  0.0  0.00  6.80   ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   32-0 31547 1/18/101   K 0.30 4     307 55158   31.8 0.60  2.81   66.249.70.108   http/1.1 schoolplus.cloudware.ng:80      GET /?p=3161159251 HTTP/1.1
   33-0 26913 1/96/156   K 2.67 0     392 88977   30.1 2.73  4.21   66.249.70.196   http/1.1 schoolplus.cloudware.ng:80      GET /?p=3174632155 HTTP/1.1
   34-0 31600 1/18/89    K 0.46 0     11  54472   57.3 0.56  2.53   36.158.7.21     http/1.1 workflow-management-software.co GET /images/u1.png HTTP/1.1
   35-0 31601 1/17/19    K 0.40 3     314 11245   32.8 0.48  0.54   66.249.70.169   http/1.1 schoolplus.cloudware.ng:80      GET /?p=2661743155 HTTP/1.1
   36-0 -     0/0/21     . 0.00 45    0   12813   0.0  0.00  0.58   ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   37-0 31603 0/11/80    _ 0.24 0     391 47841   0.0  0.29  2.28   66.249.70.139   http/1.1 schoolplus.cloudware.ng:80      GET /?p=954782661 HTTP/1.1
   38-0 -     0/0/3      . 0.00 57    0   994     0.0  0.00  0.03   ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   39-0 31605 1/20/23    K 0.52 2     304 14108   31.4 0.58  0.64   66.249.70.101   http/1.1 schoolplus.cloudware.ng:80      GET /?p=3379366793 HTTP/1.1
   40-0 -     0/0/1109   . 0.00 46    0   644863  0.0  0.00  31.94  ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   41-0 -     0/0/7      . 0.00 43    0   1042    0.0  0.00  0.06   ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   42-0 -     0/0/4      . 0.00 17801 0   1967    0.0  0.00  0.07   ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   43-0 -     0/0/41     . 0.00 17685 0   25843   0.0  0.00  1.19   ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
   44-0 -     0/0/18     . 0.00 17742 0   8912    0.0  0.00  0.42   ::1             http/1.1 chs1.nescrow.com.ng:80          OPTIONS * HTTP/1.0
     __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

    Srv  Child Server number - generation
    PID  OS process ID
    Acc  Number of accesses this connection / this child / this slot
     M   Mode of operation
    CPU  CPU usage, number of seconds
    SS   Seconds since beginning of most recent request
    Req  Milliseconds required to process most recent request
    Dur  Sum of milliseconds required to process all requests
   Conn  Kilobytes transferred this connection
   Child Megabytes transferred this child
   Slot  Total megabytes transferred this slot
     __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

   SSL/TLS Session Cache Status:
   cache type: SHMCB, shared memory: 1024000 bytes, current entries: 386
   subcaches: 32, indexes per subcache: 177
   time left on oldest entries' objects: avg: 23 seconds, (range: 0...115)
   index usage: 6%, cache usage: 9%
   total entries stored since starting: 26551
   total entries replaced since starting: 0
   total entries expired since starting: 26156
   total (pre-expiry) entries scrolled out of the cache: 0
   total retrieves since starting: 10 hit, 147 miss
   total removes since starting: 9 hit, 9 miss
Youez - 2016 - github.com/yon3zu
LinuXploit