Qmail up load avrage to 37 !!

[letux]

Hello Mostafa

please look to screen shoot : http://imgur.com/a/DFh0J

i'm disabled qmail now and load average back to 0.75 ~
what's the wrong ?

sysinfo:

Code: [Select]

# sh /script/sysinfo
A. Control Panel:               
   - Kloxo-MR: 7.0.0.b-2017011101
   - Web: hiawatha-10.4.0-f.1.mr.el6.x86_64
   - PHP: php54s-5.4.45-1.ius.el6 (fpm mode)
B. Plateform:
   - OS: CentOS release 6.8 (Final) x86_64
   - Hostname: mogardfkra.com
C. Services:
   1. MySQL: MariaDB-server-10.0.29-1.el6.x86_64
   2. PHP:
      - Installed:
        - Branch: php56w-cli-5.6.29-1.w6.x86_64
        - Multiple:
          * php52m-5.2.17-102.mr.el6
          * php53m-5.3.29-1.ius.el6
          * php54m-5.4.45-1.ius.el6
          * php55m-5.5.38-1.ius.el6
          * php56m-5.6.29-1.ius.el6
          * php70m-7.0.14-3.ius.el6
      - Used: php56m-fpm
      - Multiple: disable
   3. Web Used: nginxproxy
     - Hiawatha: hiawatha-10.4.0-f.1.mr.el6.x86_64
     - Lighttpd: lighttpd-1.4.44-1.el6.x86_64
     - Nginx: nginx-1.11.8-1.el6.ngx.x86_64
     - Apache: httpd24u-2.4.25-2.ius.el6.x86_64
       - PHP Type: php-fpm_event
       - Secondary PHP: on
   4. WebCache: none
     - ATS: --uninstalled--
     - Squid: --uninstalled--
     - Varnish: --uninstalled--
   5. Dns: bind
     - Bind: bind-9.9.7-1.mr.el6.x86_64
     - DJBDns: --uninstalled--
     - NSD: --uninstalled--
     - PowerDNS: --uninstalled--
     - Yadifa: --uninstalled--
   6. Mail: qmail-toaster-1.03-1.3.55.mr.el6.x86_64
      - pop3/imap4: courier-imap-toaster-4.1.2-1.3.20.mr.el6.x86_64
      - smtp: none
      - spam: --uninstalled--
   7. Stats: webalizer
D. Memory:
                total       used       free     shared    buffers     cached
   Mem:          3959       3322        637          1        574       1310
   -/+ buffers/cache:       1436       2522
   Swap:            0          0          0
E. Disk Space:
   Filesystem      Size  Used Avail Use% Mounted on
   /dev/vda1        59G   18G   39G  32% /


[MRatWork]

Check 'mail queue' for domains. Maybe too much send mails where possible certain website hacked.

[letux]

yes, it's all emails like this : http://imgur.com/a/NjM3c
how to know if website hacked ?
the mails out from just 4 mail and this website have 12 mail address

[MRatWork]

If using wordpress, install wordfence plugins.