Ok…I just solved my php-fpm-problem with a single firewall-rule. A russian ip-address-range accessed xmlrpc.php again and again.