Having spent time looking through the logs at that time it is apparent there is a high amount of attempt SSH login attemps from random usernames and multiple IP Addresses so the site appears to be under a brute force attack constantly between 06:30 and 10:30, those 100% CPU load times... I have increased the IP banning legth of time from 600 seconds to 1440 and hopefully this will act as a deterrent. I'll keep monitoring it.

Thanks for looking at this. Is it coming from any region and can that be blocked. Does the hosting company offer any ddos protection?

Now high load time has shifted to 06:00 - 14:00, but it looks better than it was... yes there is ddos protection to a degree but its not great, I am going to review the logs this weekend to see if it is region specific.

South Korea, China, UK, US, Japan... Tencent Cloud Computing

Vietnam... Vietnam Posts And Telecommunications Group

Russia... Chang Way Technologies Co. Limited

I've set it so that it bans IP's for 24 hours if a retry is performed within 24 hours with 1 retry... for some reason it won't let me do 0 retries. There is also now lots of attempts to log in to email accounts that don't exist and the hosting account...

Thanks for looking into this Peter. Funnily enough dealing with a ddos at work at the moment.

Ok, found the culprit, I'll work on a solution later today, just need to research on how to make some amends.

Seems like it could be corrupt

https://support.plesk.com/hc/en-us/arti ... esk-server

ok... so I have removed awstats, I never used it anyway, then I also did some house work... hopefully tomorrow the server will not be at 100% between 06:00 and 13:00

Side by side comparison of yesterday vs today, looks like I fixed it!