Hi Carol and Team,
 
Apologies on the long delays and thank you for your patience here! If you are seeking immediately assistance like with downtime on Friday, please open a chat/call as we’re open 24/7, unfortunately ticket replies will be slower and not as helpful in emergencies!
 
I’m glad to see that your initial issue was resolved, after checking the usage graphs it seems it has not returned since. 

---

In terms of your next request:

In light of the bot attack, can you run a scan to make sure none of the data was breeched?

 
We don’t have evidence that this was a bot attack at this time. From what I see, the 504s were received by the most up-to-date Chrome User Agent and the 504s seem to have been due to the high load on the server which was caused by the plugin azpc-directory slow queries. I do agree that there was a sudden and large spike in requests around that time and if you were not expecting high traffic, then it was likely bots/crawlers spamming your site and causing the issue in the first place. This generally doesn’t cause data breeches and that isn’t exactly something we can even scan for, however I ran your site through Sucuri’s SiteCheck to see if it detects any malware/issues, which came back clean: https://sitecheck.sucuri.net/results/mountainline.az.gov
 
You can also install WordFence temporarily to run a scan as that sometimes catches more things! If the WordFence scan gives you reason for concern, then we can pass that along to our security partners for a malware scan/cleaning next!

---

As for the Friday downtime, I’m not seeing anything happening on the usage graphs or in the logs so far. Are you able to share some more details such as:

• What domain(s) were down?
• What error did you see on the site(s)?
• When you said you’re getting some status messages, did you mean a monitoring service/plugin? Can you share more information on this?

 
Once we know more, we can look into this again, however at a first glance nothing seems amiss so far.

---

Hopefully this has been helpful and we look forward to continue assisting you! As always, feel free to hop in a chat/call with ticket ID #8014766 should you need anything!

It looks like we may be having some sites go down again. I’m getting some status messages. Can you take a look? 

—

[Kind regards,]

[photo]

Support Team
RadiateU

480-485-8784 [tel:480-485-8784]  |  https://radiateu.com [https://radiateu.com]

support@radiateu.com

 

[__tpx__]

Hello,

In light of the bot attack, can you run a scan to make sure none of the data was breeched? I’ve added Joseph McClellan on this as a CC so please reply to all so that he can see the reply.

Thank you,
Carol

Hi there,
 
As discussed in our recent chat, the CPU usage on the server was maxed out due to MySQL usage coming from the azprioritycare environment. Here is an example query that we found:
 

SELECT wp_posts.ID FROM wp_posts INNER JOIN wp_postmeta ON ( wp_posts.ID = wp_postmeta.post_id ) INNER JOIN wp_postmeta AS mt1 ON ( wp_posts.ID = mt1.post_id ) INNER JOIN wp_postmeta AS mt2 ON ( wp_posts.ID = mt2.post_id ) WHERE 1=1 AND ( ( wp_postmeta.meta_key = 'plan' AND wp_postmeta.meta_value = 'SCAN Health Plan' ) AND ( mt1.meta_key = 'parent_specialty' AND mt1.meta_value = 'Specialist Providers' ) AND ( mt2.meta_key = 'specialty' AND mt2.meta_value = 'Cardiovascular Disease' ) ) AND wp_posts.post_type = 'provider' AND ((wp_posts.post_status = 'publish')) AND wp_posts.ID IN (SELECT post_id FROM azpc_coords WHERE ( 3959 * acos( cos( radians(33.009998) ) * cos( radians( latitude ) ) * cos( radians( longitude ) - radians(-111.970001) ) + sin( radians(33.009998) ) * sin( radians( latitude ) ) ) ) <= 50 ) AND wp_posts.ID NOT IN (SELECT post_id FROM azpc_coords WHERE latitude = 0 AND longitude = 0) GROUP BY wp_posts.ID ORDER BY wp_posts.post_title ASC LIMIT 0, 300 /* From [azprioritycare.com/wp-json/azpc/v1/find-a-provider/?plan=SCAN%20Health%20Plan&parent_specialty=Specialist%20Providers&specialty=Cardiovascular%20Disease&azpc-search=true&radius=50&location=85138] in [/www/docsradiateucom_881/public/wp-content/plugins/azpc-directory/includes/classes/class.Results.php:250] */

 
To address this immediately, we went ahead and disabled the azpc-directory plugin as discussed in our chat. This was able to drop the cpu/mysql usage and get your other sites back online. When you get the chance, please have your dev take a look at this plugin/query and optimize as needed. I’ve attached a slow query report to this email as well.
 
If you have any further issues, questions or concerns please feel free to reach back out to us at any time. Thank you for choosing WP Engine and have a great day!
 
Best regards,

Please let me know as soon as you have blocked that user agent and the other sites are restored.

Carol

On Thu Jul 31, 2025, 04:29 AM GMT, Carol Stambaugh wrote:

Yes, please do that because all of our sites are now down.

Yes, please do that because all of our sites are now down.

Hi there, 
 
Looking at the sites, it appears that the azprioritycare site is generating a lot of 504 errors that may be affecting the other sites. That site has generated over 12813 504 errors, and it looks like this user agent is hitting the site quite a bit: 
 

21140 visits by Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

 
Let me know if you need us to block that user agent on the azprioritycare site environment. 
 
If you have any additional questions or concerns, let us know by responding to the ticket, and we will get back to you as soon as possible.

(9:26:18 PM) Bot: Conversation Transcript:
Here is a summary of the chat: Assistance is needed regarding the website https://mountainline.az.gov/, which appears to be down. There is an active incident reported by WP Engine affecting the User Portal service, potentially related to this issue. A support PIN (B67031) has been provided for verification during the transfer to a support agent.

[Chatbot]: I’ll ask you a few quick questions so I can best direct your query.What do you need help with?

[user]: (Active Outages)

[Chatbot]: WP Engine has reported 1 active incident:

– ‘wpengine.com intermittently down’, affecting the User Portal service.

If you would like to view outage information or subscribe to updates, you can do so here: [WP Engine Status Hub](https://wpenginestatus.com/).

If you believe WP Engine is experiencing an unreported outage, type “support” to speak with an agent.

[user]: support

[Chatbot]: You can speak with an agent for further assistance. Please wait while I connect you to support.

[user]: This site appears to be down. https://mountainline.az.gov/

[Chatbot]: Detected Intent: (Site Down)

[Chatbot]: Thank you for letting us know. I see there is currently an active incident affecting the User Portal, which may be related to the issue you’re experiencing.

Would you like to provide more details about what you’re seeing when you try to access the site? For example, are you getting an error message, or is the page just not loading? This information will help me assist you further. If you prefer to speak directly with a technician, please let me know.

[user]: ((RESTART CONVERSATION))

[Chatbot]: I’ll ask you a few quick questions so I can best direct your query.What do you need help with?

[user]: (Active Outages)

[Chatbot]: WP Engine has reported 1 active incident:

– ‘wpengine.com intermittently down’, affecting the User Portal service.

If you would like to view outage information or subscribe to updates, you can do so here: [WP Engine Status Hub](https://wpenginestatus.com/).

If you believe WP Engine is experiencing an unreported outage, type “support” to speak with an agent.

[user]: Support

[Chatbot]: I will connect you with a support agent for further assistance. Please hold while I transfer you.

[user]: B67031 is the support pin.

The site that is down is https://mountainline.az.gov/

[Chatbot]: Detected Intent: (Site Down)

[Chatbot]: Let me get you connected to an agent. I need some quick details before I can transfer your chat.

[Chatbot]: Your PIN can be found in the lower left corner of this page.Provide the URL or domain of interest.

[user]: Support PIN: [B67031]
URL: [https://mountainline.az.gov/]

[Chatbot]: Thanks! I’m connecting you with our team.Please wait for the next available agent.

[Chatbot]: (Successfully started chat)
(9:26:22 PM) forethought_bot_wait_time: Your estimated wait time is 1-3 mins
(9:27:32 PM) Jonathan K.: Hi there!
(9:27:44 PM) RadiateU Service: Hi, we have a site outage.
(9:27:51 PM) RadiateU Service: https://mountainline.az.gov/
(9:28:25 PM) Jonathan K.: sorry to hear that,  I can take a look! Please give me just about 3-5 minutes to get your account verified and check things out here.
(9:32:29 PM) Jonathan K.: I need to step away from my desk, but I’m getting you passed to my colleague Justin along with the notes on what I’ve checked thus far, please allow them a few minutes to get caught up and check further. Thanks!
(9:33:26 PM) RadiateU Service: I also need to step away. Can you open a ticket and make sure to copy carol@radiateu.com.
(9:33:47 PM) RadiateU Service: I will check the email in about 30 minutes.
(9:33:50 PM) Justin B: Sure, I will put in a ticket right away. I will post the ticket ID # in this chat window shortly.
(9:36:53 PM) RadiateU Service: do you have the ticket numberr yet?
(9:37:27 PM) Justin B: The ticket ID is #8014766. I just haven’t finished putting in the notes yet.
(9:38:43 PM) RadiateU Service: Thanks. I will check back on the email.
(9:43:23 PM) Justin B: Sounds like a plan. You have a great rest of your day, and take care.