Theme Site Down Issue

Hi,
Our site betweencarpools.com has been going down at random times throughout the day, I have spoke to wpsitecare – our maintenance team as well as siteground – they say there seems to be issue with theme. Can you see their response below.. and let me know what can be done. This is big issue for us.
Hello Shaindy,

Thank you for contacting our Help Desk.

I have carefully revised the server logs and found it was overloaded the last time at:

[Tue Feb 20 09:41:52.629698 2018] [:error] [pid 31827] Execute of /home/shaindy7/public_html/index.php stopped because of load 33.55

I have found that at that time and hour 121 HTTP requests were generated by the following website:

Code:
root@c38433.sgvps.net [/usr/local/apache/domlogs]# cat shaindy7/betweencarpools.com-ssl_log | grep 20/Feb/2018:09:41 | wc -l
121

I have analyzed what kind of requests these were and from what I noticed the requests were mainly related to the Newspaper theme and were calling the admin-ajax.php script:

Code:
root@c38433.sgvps.net [/usr/local/apache/domlogs]# cat shaindy7/betweencarpools.com-ssl_log | grep 20/Feb/2018:09:41 | grep admin-ajax.php | wc -l
51

Here is a log of such a request:

Code:
68.197.246.165 – – [20/Feb/2018:09:41:38 -0600] “POST /wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=8.0 HTTP/1.0” 503 – “https://betweencarpools.com/?s=Nut+brittle” “Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_5 like Mac OS X) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/11.0 Mobile/15D60 Safari/604.1”

I have also found that all of these requests related to the theme, which caused the execution of the admin-ajax.php script were coming from this IP:

55 — 68.197.246.165

Which belongs to external provider:

Code:
htodorsavov@Todor-Savov:~$ host 68.197.246.165
165.246.197.68.in-addr.arpa domain name pointer ool-44c5f6a5.dyn.optonline.net.

I am not sure what this behavior is due to but it seems to be related to the theme as I mentioned.

I would recommend you to revise it and its functionalities or contact the theme developers to revise them for you.

Should you need our further assistance, do not hesitate to contact us back at anytime.

Best Regards

Todor Savov
Technical Support Team

Hi, We really need some sort of pagination , and our entire site consists of blocks, im not sure how we can remove them? Our developer saw the following issue with the theme.. can you see below:

We’ve been looking into the theme issue and there definitely appears to be some strange things happening. The fact that your theme is calling a remote location is definitely a concern. We dug into the code and found that a lot of it is obfuscated, or encrypted. Meaning we can’t even see what the code is actually doing. You can see the attached screenshot. It’s all just gibberish.

Did you hear back from the theme author yet? If you need some additional suggestions for which questions to ask, I can definitely help with that. Generally speaking though, there’s no reason for a theme to be making remote calls. The URL where the remote calls are being made appear to be going to https://www.optimum.net/, which is some kind of internet service provider. Definitely not the kind of thing a theme should be doing.