I just found out that i could not access my wordpress today, i checked the server, everything looked good. i restarted the server, it’s still slow, there is no error.
I decided to do a debug using the following command:
cd /www/myswebsite.com/httpdocs/ strace php index.php
I see my script stopped at
sendmmsg(6, {{{msg_name(0)=NULL, msg_iov(1)=[{"-\265\1\0\0\1\0\0\0\0\0\0\24tech-banker-service"..., 42}], msg_controllen=0, msg_flags=MSG_DONTROUTE|MSG_DONTWAIT|MSG_FIN|MSG_SYN|MSG_ERRQUEUE|MSG_NOSIGNAL|MSG_FASTOPEN|0x6a80010}, 42}, {{msg_name(0)=NULL, msg_iov(1)=[{"\207E\1\0\0\1\0\0\0\0\0\0\24tech-banker-service"..., 42}], msg_controllen=0, msg_flags=MSG_OOB|MSG_DONTROUTE|MSG_CTRUNC|0x10}, 42}}, 2, MSG_NOSIGNAL) = 2
poll([{fd=6, events=POLLIN}], 1, 5000) = 1 ([{fd=6, revents=POLLIN}])
ioctl(6, FIONREAD, [58]) = 0
recvfrom(6, "-\265\201\200\0\1\0\1\0\0\0\0\24tech-banker-service"..., 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("213.133.99.99")}, [16]) = 58
poll([{fd=6, events=POLLIN}], 1, 4999) = 1 ([{fd=6, revents=POLLIN}])
ioctl(6, FIONREAD, [135]) = 0
recvfrom(6, "\207E\201\200\0\1\0\0\0\1\0\0\24tech-banker-service"..., 65536, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("213.133.99.99")}, [16]) = 135
close(6) = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 6
fcntl(6, F_GETFL) = 0x2 (flags O_RDWR)
fcntl(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0
connect(6, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("63.142.254.220")}, 16) = -1 EINPROGRESS (Operation now in progress)
poll([{fd=6, events=POLLIN|POLLOUT|POLLERR|POLLHUP}],
I see that my script could not connect 63.142.254.220 , i doubted that my service is infected with some harmful script, i search 63.142.254.220 in my whole web directory
grep -r "63.142.254.220" /www/myswebsite.com/httpdocs/*
But i could not see any thing, i looked at the strace debug, i see tech-banker-service , so i did another search:
grep -r "tech-banker-service" /www/myswebsite.com/httpdocs/*
I found it:
wp-content/plugins/wp-captcha-booster/wp-captcha-booster.php: define( 'TECH_BANKER_SERVICES_URL', 'https://tech-banker-services.org' ); wp-content/plugins/wp-captcha-booster/wp-captcha-booster.php: define( 'TECH_BANKER_SERVICES_URL', 'http://tech-banker-services.org' ); wp-content/plugins/wp-captcha-booster/wp-captcha-booster.php: define( 'TECH_BANKER_STATS_URL', 'http://stats.tech-banker-services.org' );
So i go to the plugins and disable this plugin
cd wp-content/plugins/ mv wp-captcha-booster wp-captcha-booster.old
After this my site working perfectly.