What services are listening on what ports ?
netstat -tunlp or the all new ss which shares the same command options ss -tunlp
for a better view of the files ! (Depending on your setup, you might be able to know which php script is generating outgoing traffic)
lsof -nP -iTCP -sTCP:LISTEN