PHP-FPM often shows up in top when no one is on site

tagteam

Member
May 21, 2013
15
1
53
cPanel Access Level
Root Administrator
Often when I am watching top to see what is going on I will see php-fpm show up for a users account when no one is on the site. It will show up with around a 20% cpu hit and then go away. It will pop in and out for a while but as I am watching analytics no one is actually on the site.

Does anyone know why this is happening?
 
Last edited by a moderator:

tagteam

Member
May 21, 2013
15
1
53
cPanel Access Level
Root Administrator
Upon further review this appears to be bots hitting the site. For example one bot mj12bot.com hits it all the time. I disallowed that bot in the robots.txt file but it still seems to be hitting the site multiple times a minute. It mainly looks to be hitting my calendar.

144.91.125.96 - - [08/Dec/2020:11:25:36 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-24&paged=12 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:25:51 -0600] "GET /page/12/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-24 HTTP/1.1" 200 31386 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:02 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28&paged=2 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:13 -0600] "GET /page/2/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28 HTTP/1.1" 200 31383 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:26 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28&paged=6 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:34 -0600] "GET /page/6/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-28 HTTP/1.1" 200 31380 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:48 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30&paged=6 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:26:57 -0600] "GET /page/6/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30 HTTP/1.1" 200 31381 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:27:10 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30&paged=8 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:27:22 -0600] "GET /page/8/?post_type=tribe_events&eventDisplay=day&eventDate=2016-01-30 HTTP/1.1" 200 31381 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"


Can anyone confirm that this is what I am seeing? It appears to be coming from the same IP so I could block that i suppose but the mj12bot.com site says they user a range of ip's so if it is really them I don't know if it will help.
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
6,810
895
313
cPanel Access Level
Root Administrator
Hey there! That traffic is definitely their bot, so you could block the IP you're currently seeing accessing the server. If you see the IP change in the future you could just block an additional IP. That is likely the best way to handle it as then Apache doesn't have to process that traffic at all on your system.
 

tagteam

Member
May 21, 2013
15
1
53
cPanel Access Level
Root Administrator
I blocked it in the morning and around 11:30. Then an hour later I see:

144.91.125.96 - - [08/Dec/2020:11:34:55 -0600] "GET /?post_type=tribe_events&eventDisplay=day&eventDate=2016-03-04&paged=6 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
144.91.125.96 - - [08/Dec/2020:11:35:04 -0600] "GET /page/6/?post_type=tribe_events&eventDisplay=day&eventDate=2016-03-04 HTTP/1.1" 200 31372 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
167.114.157.181 - - [08/Dec/2020:12:38:38 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
167.114.64.97 - - [08/Dec/2020:12:40:37 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
167.86.74.24 - - [08/Dec/2020:13:12:53 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
167.114.157.181 - - [08/Dec/2020:13:18:14 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
148.251.9.145 - - [08/Dec/2020:15:18:52 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
192.99.4.168 - - [08/Dec/2020:15:23:47 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"
85.165.52.41 - - [08/Dec/2020:15:33:11 -0600] "GET /robots.txt HTTP/1.1" 200 282 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; MJ12Bot | Home | from Majestic)"

So it looks like, maybe now they are stopping at the robots.txt and not scanning. Is that what I am seeing going on here?