Sep  8 03:41:33 nativespace-cdp sshd[3479003]: Connection closed by 159.100.136.21 port 36096 [preauth]
Sep  8 03:46:36 nativespace-cdp sshd[3480029]: Connection closed by 159.100.136.21 port 45336 [preauth]
Sep  8 03:51:33 nativespace-cdp sshd[3481000]: Connection closed by 159.100.136.21 port 54496 [preauth]
Sep  8 03:56:33 nativespace-cdp sshd[3482158]: Connection closed by 159.100.136.21 port 36228 [preauth]
Sep  8 04:01:36 nativespace-cdp sshd[3483265]: Connection closed by 159.100.136.21 port 45708 [preauth]
Sep  8 04:06:33 nativespace-cdp sshd[3484291]: Connection closed by 159.100.136.21 port 55246 [preauth]
Sep  8 04:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 04:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:35 nativespace-cdp sudo[3485038]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 04:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:35 nativespace-cdp sudo[3485041]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 04:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:36 nativespace-cdp sudo[3485044]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 04:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:36 nativespace-cdp sudo[3485048]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 04:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:38 nativespace-cdp sudo[3485051]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:38 nativespace-cdp sudo[3485060]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:38 nativespace-cdp sudo[3485063]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:38 nativespace-cdp sudo[3485066]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:38 nativespace-cdp sudo[3485069]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:38 nativespace-cdp sudo[3485072]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:38 nativespace-cdp sudo[3485076]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 04:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:40 nativespace-cdp sudo[3485088]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 04:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:40 nativespace-cdp sudo[3485092]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=costestimatorco user-2=clarkass user-3=firstrel user-4=highlegh user-5=southlon user-6=firstred user-7=firstres user-8=ultbcrra user-9=jonhartl user-10=seftvta user-11=opaiscyx user-12=coursemc user-13=ianrayne user-14=accooper user-15=thqkgnbz user-16=connectedshoppin user-17=elecleis user-18=gilpin user-19=milloyco user-20=fetch user-21=carsinyo user-22=hubmaster user-23=putterfi user-24=bedfords user-25=bemadonn user-26=newstoda user-27=ggaaorgu user-28=belle user-29=nstriton user-30=brighto1 user-31=oneoarco user-32=battlere user-33=vivienn1 user-34=firstre2 user-35=stuartge user-36=askhform user-37=innovat1 user-38=nativene user-39=skyfirec user-40=alexadmin user-41=ulsukarm user-42=markward user-43=foundation user-44=booff user-45=lbscrmod user-46=maflemin user-47=vantagep user-48=athenare
Sep  8 04:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=connect9 user-50=agproduc user-51=still user-52=leereyn1 user-53=stephani user-54=jarvisin user-55=hodgesonweb user-56=theblack user-57=spectrum user-58=wilsonsw user-59=megacards user-60=musorguk user-61=brmrjxl user-62=lakesan1 user-63=atestord user-64=sarafoundation user-65=strathar user-66=hhdugcor user-67=lbhyisi user-68=magichat user-69=martsblo user-70=ptkxhsbt user-71=dickemery123 user-72=mcdermos user-73=chrisdal user-74=david user-75=nbhavers user-76=careers user-77=tomandle user-78=jennimil user-79=branko user-80=ranxterc user-81=outdoorc user-82=hodgsonmail user-83=romaldki user-84=lucy user-85=attlebor user-86=onlycont user-87=crrtipdl user-88=sosevalu user-89=bakery user-90=nove user-91=boldover user-92=kategilpin user-93=dancinggardener user-94=stagingerris user-95=ladburyp user-96=design user-97=what user-98=oubpgvbx user-99=tstardom user-100=nvihkvu user-101=havantho user-102=sketchy
Sep  8 04:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=cath user-104=zebrapho user-105=bwppodcast user-106=steve user-107=sibtoncc user-108=asandcoc user-109=darkstar user-110=eatspam user-111=beauty user-112=dhyana user-113=fawcettd user-114=burydropin user-115=nsceres user-116=smrszyqg user-117=isleofwi user-118=tigerlet user-119=barbersh user-120=nomistakes user-121=hidden user-122=leftie user-123=foods user-124=fortunaz user-125=health2045 user-126=nscdp user-127=putterfc user-128=donnychicago user-129=steakbridieme user-130=firstre5 user-131=philmcph user-132=ctedorgu user-133=lkpier user-134=hirefootballgame user-135=courseme user-136=eugincou user-137=reliable user-138=ninejimm user-139=cathski user-140=cambria1 user-141=cwsocial user-142=howardon user-143=pugwash user-144=paulmca1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 04:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 04:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:41 nativespace-cdp sudo[3485096]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 04:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:41 nativespace-cdp sudo[3485104]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-HJOWiOTTUU4Ividw.~
Sep  8 04:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:41 nativespace-cdp sudo[3485107]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-HJOWiOTTUU4Ividw.~'
Sep  8 04:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:41 nativespace-cdp sudo[3485110]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-HJOWiOTTUU4Ividw.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 04:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:41 nativespace-cdp sudo[3485114]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 04:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:41 nativespace-cdp sudo[3485117]: pam_unix(sudo:session): session closed for user root
Sep  8 04:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 04:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:09:42 nativespace-cdp sudo[3485138]: pam_unix(sudo:session): session closed for user root
Sep  8 04:11:33 nativespace-cdp sshd[3485930]: Connection closed by 159.100.136.21 port 36156 [preauth]
Sep  8 04:16:34 nativespace-cdp sshd[3487055]: Connection closed by 159.100.136.21 port 44908 [preauth]
Sep  8 04:21:33 nativespace-cdp sshd[3488362]: Connection closed by 159.100.136.21 port 54150 [preauth]
Sep  8 04:26:33 nativespace-cdp sshd[3489625]: Connection closed by 159.100.136.21 port 35542 [preauth]
Sep  8 04:31:33 nativespace-cdp sshd[3490931]: Connection closed by 159.100.136.21 port 44878 [preauth]
Sep  8 04:35:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 04:35:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:35:06 nativespace-cdp sudo[3491728]: pam_unix(sudo:session): session closed for user root
Sep  8 04:36:35 nativespace-cdp sshd[3492341]: Connection closed by 159.100.136.21 port 54216 [preauth]
Sep  8 04:41:33 nativespace-cdp sshd[3495151]: Connection closed by 159.100.136.21 port 35270 [preauth]
Sep  8 04:46:33 nativespace-cdp sshd[3496800]: Connection closed by 159.100.136.21 port 43852 [preauth]
Sep  8 04:51:35 nativespace-cdp sshd[3498191]: Connection closed by 159.100.136.21 port 51962 [preauth]
Sep  8 04:56:34 nativespace-cdp sshd[3499491]: Connection closed by 159.100.136.21 port 33148 [preauth]
Sep  8 04:56:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 04:56:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:56:38 nativespace-cdp sudo[3499516]: pam_unix(sudo:session): session closed for user root
Sep  8 04:56:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 04:56:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:56:38 nativespace-cdp sudo[3499527]: pam_unix(sudo:session): session closed for user root
Sep  8 04:56:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 04:56:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:56:43 nativespace-cdp sudo[3499547]: pam_unix(sudo:session): session closed for user root
Sep  8 04:56:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=oneoarco user-2=battlere user-3=vivienn1 user-4=firstre2 user-5=nstriton user-6=brighto1 user-7=bemadonn user-8=newstoda user-9=belle user-10=ggaaorgu user-11=bedfords user-12=alexadmin user-13=skyfirec user-14=nativene user-15=stuartge user-16=askhform user-17=innovat1 user-18=opaiscyx user-19=coursemc user-20=firstres user-21=ultbcrra user-22=jonhartl user-23=seftvta user-24=highlegh user-25=southlon user-26=firstred user-27=costestimatorco user-28=clarkass user-29=firstrel user-30=fetch user-31=carsinyo user-32=hubmaster user-33=putterfi user-34=elecleis user-35=milloyco user-36=gilpin user-37=thqkgnbz user-38=connectedshoppin user-39=ianrayne user-40=accooper user-41=atestord user-42=sarafoundation user-43=strathar user-44=lakesan1 user-45=brmrjxl user-46=megacards user-47=musorguk
Sep  8 04:56:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=wilsonsw user-49=ptkxhsbt user-50=dickemery123 user-51=martsblo user-52=magichat user-53=hhdugcor user-54=lbhyisi user-55=lbscrmod user-56=maflemin user-57=vantagep user-58=connect9 user-59=athenare user-60=markward user-61=foundation user-62=booff user-63=ulsukarm user-64=hodgesonweb user-65=theblack user-66=spectrum user-67=jarvisin user-68=leereyn1 user-69=stephani user-70=agproduc user-71=still user-72=boldover user-73=nove user-74=crrtipdl user-75=sosevalu user-76=bakery user-77=nvihkvu user-78=havantho user-79=sketchy user-80=cath user-81=what user-82=oubpgvbx user-83=tstardom user-84=design user-85=kategilpin user-86=stagingerris user-87=dancinggardener user-88=ladburyp user-89=jennimil user-90=tomandle user-91=david user-92=careers user-93=nbhavers user-94=mcdermos user-95=chrisdal user-96=onlycont user-97=lucy user-98=attlebor user-99=romaldki user-100=branko user-101=hodgsonmail
Sep  8 04:56:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ranxterc user-103=outdoorc user-104=steakbridieme user-105=firstre5 user-106=donnychicago user-107=philmcph user-108=ctedorgu user-109=lkpier user-110=leftie user-111=foods user-112=fortunaz user-113=health2045 user-114=nscdp user-115=putterfc user-116=tigerlet user-117=barbersh user-118=nomistakes user-119=hidden user-120=smrszyqg user-121=isleofwi user-122=cwsocial user-123=howardon user-124=paulmca1 user-125=pugwash user-126=ninejimm user-127=reliable user-128=cambria1 user-129=cathski user-130=courseme user-131=eugincou user-132=hirefootballgame user-133=sibtoncc user-134=asandcoc user-135=steve user-136=zebrapho user-137=bwppodcast user-138=nsceres user-139=fawcettd user-140=burydropin user-141=dhyana user-142=darkstar user-143=eatspam user-144=beauty feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  8 04:56:43 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 04:56:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:56:44 nativespace-cdp sudo[3499553]: pam_unix(sudo:session): session closed for user root
Sep  8 04:56:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  8 04:56:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:56:45 nativespace-cdp sudo[3499568]: pam_unix(sudo:session): session closed for user root
Sep  8 04:56:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep  8 04:56:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:56:45 nativespace-cdp sudo[3499575]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  8 04:57:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:57:07 nativespace-cdp sudo[3499707]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:57:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  8 04:57:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:57:08 nativespace-cdp sudo[3499713]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep  8 04:57:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:57:09 nativespace-cdp sudo[3499724]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep  8 04:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:57:11 nativespace-cdp sudo[3499731]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  8 04:57:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:57:11 nativespace-cdp sudo[3499739]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep  8 04:57:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:57:15 nativespace-cdp sudo[3499761]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep  8 04:57:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:57:19 nativespace-cdp sudo[3499770]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep  8 04:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:57:19 nativespace-cdp sudo[3499855]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep  8 04:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:57:20 nativespace-cdp sudo[3499862]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep  8 04:57:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:57:27 nativespace-cdp sudo[3499950]: pam_unix(sudo:session): session closed for user root
Sep  8 04:57:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  8 04:57:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:57:30 nativespace-cdp sudo[3500016]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:57:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  8 04:57:31 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  8 04:57:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  8 04:57:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:57:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:57:31 nativespace-cdp sudo[3500023]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:57:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  8 04:57:31 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  8 04:57:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  8 04:57:31 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:57:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:57:55 nativespace-cdp sudo[3500031]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:58:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  8 04:58:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:58:08 nativespace-cdp sudo[3500236]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:58:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  8 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  8 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  8 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:58:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:58:08 nativespace-cdp sudo[3500243]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:58:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  8 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  8 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  8 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:58:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:58:08 nativespace-cdp sudo[3500251]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:58:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  8 04:58:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:58:10 nativespace-cdp sudo[3500293]: pam_unix(sudo:session): session closed for user root
Sep  8 04:58:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep  8 04:58:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:58:10 nativespace-cdp sudo[3500299]: pam_unix(sudo:session): session closed for user root
Sep  8 04:58:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  8 04:58:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 04:58:34 nativespace-cdp sudo[3500503]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 04:58:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep  8 04:58:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:58:34 nativespace-cdp sudo[3500514]: pam_unix(sudo:session): session closed for user root
Sep  8 04:58:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep  8 04:58:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:58:35 nativespace-cdp sudo[3500519]: pam_unix(sudo:session): session closed for user root
Sep  8 04:58:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  8 04:58:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:58:35 nativespace-cdp sudo[3500527]: pam_unix(sudo:session): session closed for user root
Sep  8 04:58:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep  8 04:58:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:58:36 nativespace-cdp sudo[3500541]: pam_unix(sudo:session): session closed for user root
Sep  8 04:58:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep  8 04:58:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:58:36 nativespace-cdp sudo[3500549]: pam_unix(sudo:session): session closed for user root
Sep  8 04:58:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep  8 04:58:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:58:42 nativespace-cdp sudo[3500628]: pam_unix(sudo:session): session closed for user root
Sep  8 04:58:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  8 04:58:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 04:58:44 nativespace-cdp sudo[3500686]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 04:58:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  8 04:58:45 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  8 04:58:45 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  8 04:58:45 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:58:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 04:58:45 nativespace-cdp sudo[3500693]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 04:58:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  8 04:58:45 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  8 04:58:45 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  8 04:58:45 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:58:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 04:58:57 nativespace-cdp sudo[3500700]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 04:58:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  8 04:58:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  8 04:58:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  8 04:58:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:58:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 04:58:58 nativespace-cdp sudo[3500736]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  8 04:59:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 04:59:04 nativespace-cdp sudo[3500871]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:59:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 04:59:04 nativespace-cdp sudo[3500878]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:59:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 04:59:04 nativespace-cdp sudo[3500885]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  8 04:59:04 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:59:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 04:59:05 nativespace-cdp sudo[3500892]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 04:59:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  8 04:59:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:07 nativespace-cdp sudo[3500931]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep  8 04:59:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:07 nativespace-cdp sudo[3500937]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep  8 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:13 nativespace-cdp sudo[3500962]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep  8 04:59:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:13 nativespace-cdp sudo[3500970]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  8 04:59:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  8 04:59:14 nativespace-cdp sudo[3500985]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  8 04:59:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep  8 04:59:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:14 nativespace-cdp sudo[3500993]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep  8 04:59:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:14 nativespace-cdp sudo[3500998]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep  8 04:59:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:16 nativespace-cdp sudo[3501004]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  8 04:59:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:16 nativespace-cdp sudo[3501016]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  8 04:59:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:59:32 nativespace-cdp sudo[3501103]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:59:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  8 04:59:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:32 nativespace-cdp sudo[3501110]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  8 04:59:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:33 nativespace-cdp sudo[3501116]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep  8 04:59:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:34 nativespace-cdp sudo[3501136]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep  8 04:59:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 04:59:41 nativespace-cdp sudo[3501211]: pam_unix(sudo:session): session closed for user root
Sep  8 04:59:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  8 04:59:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:59:43 nativespace-cdp sudo[3501273]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:59:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  8 04:59:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  8 04:59:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  8 04:59:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:59:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 04:59:45 nativespace-cdp sudo[3501283]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 04:59:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  8 04:59:45 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  8 04:59:45 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  8 04:59:45 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 04:59:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 05:00:02 nativespace-cdp sudo[3501291]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 05:00:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  8 05:00:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 05:00:08 nativespace-cdp sudo[3501606]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 05:00:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  8 05:00:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  8 05:00:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  8 05:00:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 05:00:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 05:00:08 nativespace-cdp sudo[3501612]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 05:00:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  8 05:00:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  8 05:00:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  8 05:00:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  8 05:00:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 05:00:08 nativespace-cdp sudo[3501618]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 05:00:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  8 05:00:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:00:10 nativespace-cdp sudo[3501656]: pam_unix(sudo:session): session closed for user root
Sep  8 05:00:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep  8 05:00:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:00:11 nativespace-cdp sudo[3501661]: pam_unix(sudo:session): session closed for user root
Sep  8 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  8 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  8 05:00:37 nativespace-cdp sudo[3501792]: pam_unix(sudo:session): session closed for user fortunaz
Sep  8 05:00:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep  8 05:00:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:00:38 nativespace-cdp sudo[3501798]: pam_unix(sudo:session): session closed for user root
Sep  8 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep  8 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:00:39 nativespace-cdp sudo[3501804]: pam_unix(sudo:session): session closed for user root
Sep  8 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  8 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:00:39 nativespace-cdp sudo[3501810]: pam_unix(sudo:session): session closed for user root
Sep  8 05:00:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep  8 05:00:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:00:42 nativespace-cdp sudo[3501828]: pam_unix(sudo:session): session closed for user root
Sep  8 05:00:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  8 05:00:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:00:42 nativespace-cdp sudo[3501836]: pam_unix(sudo:session): session closed for user root
Sep  8 05:00:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep  8 05:00:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:00:47 nativespace-cdp sudo[3501905]: pam_unix(sudo:session): session closed for user root
Sep  8 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco WpToolkitNotification send_admin_auto_updates_notification available_updates_text= available_updates_list= installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep  8 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:00:59 nativespace-cdp sudo[3502147]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep  8 05:01:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:10 nativespace-cdp sudo[3502308]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  8 05:01:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:10 nativespace-cdp sudo[3502313]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502319]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502323]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502328]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502333]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502339]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502343]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502349]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502353]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502358]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502363]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502369]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502373]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502379]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502383]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502388]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:11 nativespace-cdp sudo[3502393]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502399]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502403]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502409]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502413]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502419]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502424]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502430]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502435]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502440]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502444]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502450]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502455]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502461]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502465]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502471]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502475]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502480]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502485]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502491]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502495]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502501]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502505]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502510]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:12 nativespace-cdp sudo[3502515]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502521]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502525]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502531]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502535]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502541]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502546]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502552]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502557]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502563]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502567]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502573]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502578]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502584]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502588]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502594]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502598]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502603]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502608]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502614]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502618]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502625]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502630]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502634]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:13 nativespace-cdp sudo[3502639]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502646]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502650]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502656]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502660]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502666]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502671]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502677]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502681]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502687]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502692]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502696]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502702]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502707]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502711]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502717]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502721]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502726]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502731]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502737]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502741]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502747]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502751]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502756]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:14 nativespace-cdp sudo[3502761]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502767]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502771]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502777]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502781]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502786]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502792]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502798]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502802]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502808]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502812]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502817]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502822]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502828]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502832]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502838]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502842]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502847]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502852]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502858]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502862]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502868]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502872]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502877]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502883]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:15 nativespace-cdp sudo[3502888]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502892]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502898]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502902]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502907]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502912]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502919]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502923]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502929]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502933]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502938]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502943]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502949]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502953]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502959]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502963]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502968]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502974]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502979]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502983]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502989]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502993]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3502998]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3503003]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3503009]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3503013]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3503019]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:16 nativespace-cdp sudo[3503023]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503028]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503033]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503039]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503043]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503049]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503053]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503059]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503064]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503070]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503074]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503080]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503085]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503089]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503095]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503100]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503104]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503110]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503114]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503119]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503124]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503131]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503135]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503141]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503145]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503150]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503156]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503161]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  8 05:01:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:17 nativespace-cdp sudo[3503165]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503172]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503176]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503181]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503187]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503192]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503197]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503203]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503207]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503212]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503218]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503223]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503227]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503233]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503238]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503243]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503247]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503254]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503258]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503264]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503268]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503274]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503279]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503285]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503289]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:18 nativespace-cdp sudo[3503294]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503298]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503304]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503309]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503315]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503319]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503326]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503330]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503336]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503342]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503348]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503352]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503358]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503363]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503368]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503373]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503379]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503383]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503389]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503393]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503398]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503403]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503409]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503413]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503419]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503423]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  8 05:01:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:19 nativespace-cdp sudo[3503429]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  8 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:20 nativespace-cdp sudo[3503433]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  8 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:20 nativespace-cdp sudo[3503439]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  8 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:20 nativespace-cdp sudo[3503443]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  8 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:20 nativespace-cdp sudo[3503449]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  8 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:20 nativespace-cdp sudo[3503453]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/design/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:20 nativespace-cdp sudo[3503460]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/aberdeen-guesthouses.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:20 nativespace-cdp sudo[3503464]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/aberdeen-guesthouses.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:20 nativespace-cdp sudo[3503469]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/accooper/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:21 nativespace-cdp sudo[3503474]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/agproduc/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:21 nativespace-cdp sudo[3503479]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/altrincham -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:21 nativespace-cdp sudo[3503485]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/wp-content
Sep  8 05:01:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:21 nativespace-cdp sudo[3503492]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/wp-config.php
Sep  8 05:01:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:21 nativespace-cdp sudo[3503497]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/.wp-toolkit-ignore
Sep  8 05:01:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:21 nativespace-cdp sudo[3503502]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/amarawetherall.me.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:21 nativespace-cdp sudo[3503508]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/amarawetherall.me.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:21 nativespace-cdp sudo[3503512]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html/amcalenan -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503517]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-content
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503529]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-config.php
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503534]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/.wp-toolkit-ignore
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503539]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html/amcalenan -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503545]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-content
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503549]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-config.php
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503554]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/.wp-toolkit-ignore
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503559]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/thqkgnbz/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503565]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/thqkgnbz/public_html/testwp/wp-content
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503570]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/thqkgnbz/public_html/testwp/wp-config.php
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503575]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/thqkgnbz/public_html/testwp/.wp-toolkit-ignore
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503580]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/sinclairmanagement -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:24 nativespace-cdp sudo[3503585]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/asandcoc/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503590]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/asandcoc/public_html/blog/wp-content
Sep  8 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503595]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/asandcoc/public_html/blog/wp-config.php
Sep  8 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503600]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/asandcoc/public_html/blog/.wp-toolkit-ignore
Sep  8 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503605]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/askhform/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503611]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503616]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/athenars.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503621]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/athenars.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503626]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/attlebor/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503631]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/auchendennanltd.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:25 nativespace-cdp sudo[3503636]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/auchendennanltd.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:26 nativespace-cdp sudo[3503641]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/backinawhile -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:26 nativespace-cdp sudo[3503646]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/backinawhile -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:26 nativespace-cdp sudo[3503651]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/opaiscyx/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:26 nativespace-cdp sudo[3503656]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bwppodcast/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:32 nativespace-cdp sudo[3503662]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/bargeton.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:32 nativespace-cdp sudo[3503680]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/bargeton.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:32 nativespace-cdp sudo[3503686]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/battlere/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:32 nativespace-cdp sudo[3503690]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/battlere/public_html/home/wp-content
Sep  8 05:01:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:32 nativespace-cdp sudo[3503698]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/battlere/public_html/home/wp-config.php
Sep  8 05:01:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:32 nativespace-cdp sudo[3503703]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/battlere/public_html/home/.wp-toolkit-ignore
Sep  8 05:01:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:32 nativespace-cdp sudo[3503708]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bedfords/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:33 nativespace-cdp sudo[3503714]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bedfords/public_html/wp-content
Sep  8 05:01:33 nativespace-cdp sshd[3503716]: Connection closed by 159.100.136.21 port 42260 [preauth]
Sep  8 05:01:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:33 nativespace-cdp sudo[3503719]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bedfords/public_html/wp-config.php
Sep  8 05:01:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:33 nativespace-cdp sudo[3503725]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bedfords/public_html/.wp-toolkit-ignore
Sep  8 05:01:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:33 nativespace-cdp sudo[3503730]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/belle/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:33 nativespace-cdp sudo[3503736]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bemadonn/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:33 nativespace-cdp sudo[3503740]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brighto1/bhlabour.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503745]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/wp-content
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503766]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503771]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/../wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503776]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wp-content
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503782]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503786]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/../wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503791]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503796]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503801]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/.wp-toolkit-ignore
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503806]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brighto1/bhlabour.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503811]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/wp-content
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503816]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503821]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wordpress/../wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503826]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wp-content
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503831]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503836]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content/cache/tw_optimize/page_cache/www.bhlabour.org.uk/../wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503841]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-content
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503846]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/wp-config.php
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503851]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/brighto1/bhlabour.org.uk/.wp-toolkit-ignore
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:39 nativespace-cdp sudo[3503857]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/birmingham -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503863]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/wp-content
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503869]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/wp-config.php
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503874]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/.wp-toolkit-ignore
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503879]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/blackburn -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503885]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/wp-content
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503889]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/wp-config.php
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503894]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/.wp-toolkit-ignore
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503899]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/jalbum/jeremy/public_html/BattleofBritain -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503904]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/boldover-graphic-design.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503911]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-content
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503918]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-config.php
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503923]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/.wp-toolkit-ignore
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503928]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/boldover-graphic-design.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503933]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-content
Sep  8 05:01:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:40 nativespace-cdp sudo[3503938]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-config.php
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503943]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/.wp-toolkit-ignore
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503948]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503953]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/wp-content
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503960]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/wp-config.php
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503965]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/.wp-toolkit-ignore
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503970]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-content
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503975]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-config.php
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503980]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/.wp-toolkit-ignore
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503985]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/boldver.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503990]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/boldver.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:41 nativespace-cdp sudo[3503995]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/bolton -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504000]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/wp-content
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504007]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/wp-config.php
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504012]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/.wp-toolkit-ignore
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504018]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/booff/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504023]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/bramptonabbotts.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504028]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/bramptonabbotts.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504033]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/bridstow-school.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504037]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/bridstow-school.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504043]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brighto1/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504050]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brmrjxl/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:42 nativespace-cdp sudo[3504055]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/burnley -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504061]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/wp-content
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504065]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/wp-config.php
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504070]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/.wp-toolkit-ignore
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504076]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/burtonupontrent -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504081]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/wp-content
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504086]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/wp-config.php
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504091]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/.wp-toolkit-ignore
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504096]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/bury -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504102]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/wp-content
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504106]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/wp-config.php
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504112]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/.wp-toolkit-ignore
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504117]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/burydropin/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504122]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cambria1/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504127]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/cambridge -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504133]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/candidacanbefun.co.uk/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504139]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/candidacanbefun.co.uk/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:43 nativespace-cdp sudo[3504143]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/crete/wordpress -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504148]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/crete/wordpress -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504153]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/catherinejonesart.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504159]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/catherinejonesart.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504166]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/chale-bay-farm.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504171]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/chale-bay-farm.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504176]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/chale-bay-farm.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504181]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/chale-bay-farm.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504186]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html/channel-capital.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504191]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html/channel-capital.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504196]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504201]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504206]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html/channelcapital.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504212]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nvihkvu/public_html/channelcapital.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504217]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/chorley -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504222]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/wp-content
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504226]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/wp-config.php
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504231]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/.wp-toolkit-ignore
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:44 nativespace-cdp sudo[3504236]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/chorleyhandyman.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504242]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/chorleyhandyman.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504246]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504251]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504257]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504262]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504268]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/christchurchfod.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504273]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/christchurchfod.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504278]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/churchdownclub.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504282]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/churchdownclub.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504287]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/churchdownmvc.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504292]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/churchdownmvc.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:45 nativespace-cdp sudo[3504297]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/churchdownvillagebowls.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:46 nativespace-cdp sudo[3504302]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/churchdownvillagebowls.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:46 nativespace-cdp sudo[3504307]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/clark.associates -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:46 nativespace-cdp sudo[3504312]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/clark.associates -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:46 nativespace-cdp sudo[3504318]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:46 nativespace-cdp sudo[3504323]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:46 nativespace-cdp sudo[3504328]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/clerks -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:46 nativespace-cdp sudo[3504334]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/cmvc.skyfire-designs.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:46 nativespace-cdp sudo[3504338]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/code/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:46 nativespace-cdp sudo[3504343]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/colingrieve.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:47 nativespace-cdp sudo[3504348]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/colingrieve.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:47 nativespace-cdp sudo[3504354]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/connect9/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:47 nativespace-cdp sudo[3504359]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html/www.coriniumcapital.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:47 nativespace-cdp sudo[3504363]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html/www.coriniumcapital.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:47 nativespace-cdp sudo[3504368]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/costestimatorco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:52 nativespace-cdp sudo[3504374]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/costestimatorco/public_html/wp-content
Sep  8 05:01:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:52 nativespace-cdp sudo[3504392]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/costestimatorco/public_html/wp-config.php
Sep  8 05:01:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:52 nativespace-cdp sudo[3504398]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/costestimatorco/public_html/.wp-toolkit-ignore
Sep  8 05:01:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:52 nativespace-cdp sudo[3504402]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oubpgvbx/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:52 nativespace-cdp sudo[3504408]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/coventry -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:53 nativespace-cdp sudo[3504414]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/wp-content
Sep  8 05:01:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:53 nativespace-cdp sudo[3504418]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/wp-config.php
Sep  8 05:01:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:53 nativespace-cdp sudo[3504423]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/.wp-toolkit-ignore
Sep  8 05:01:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:53 nativespace-cdp sudo[3504428]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ctedorgu/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:53 nativespace-cdp sudo[3504434]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/cvs.media -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:53 nativespace-cdp sudo[3504441]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/cvs.media -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:53 nativespace-cdp sudo[3504446]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cwsocial/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:54 nativespace-cdp sudo[3504451]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/wp-content
Sep  8 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:54 nativespace-cdp sudo[3504458]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/wp-config.php
Sep  8 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:54 nativespace-cdp sudo[3504463]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/.wp-toolkit-ignore
Sep  8 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:54 nativespace-cdp sudo[3504468]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cwsocial/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:54 nativespace-cdp sudo[3504474]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/wp-content
Sep  8 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:54 nativespace-cdp sudo[3504478]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/wp-config.php
Sep  8 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:54 nativespace-cdp sudo[3504485]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/cwsocial/public_html/.wp-toolkit-ignore
Sep  8 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:54 nativespace-cdp sudo[3504489]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/dancinggardener/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:55 nativespace-cdp sudo[3504494]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dancinggardener/public_html/wp-content
Sep  8 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:55 nativespace-cdp sudo[3504499]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dancinggardener/public_html/wp-config.php
Sep  8 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:55 nativespace-cdp sudo[3504505]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dancinggardener/public_html/.wp-toolkit-ignore
Sep  8 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:55 nativespace-cdp sudo[3504509]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/darkstar/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:55 nativespace-cdp sudo[3504515]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ddlc.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:55 nativespace-cdp sudo[3504521]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ddlc.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:55 nativespace-cdp sudo[3504525]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/derby -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504530]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/wp-content
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504535]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/wp-config.php
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504541]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/.wp-toolkit-ignore
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504546]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/dev.boldover.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504550]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/dev.boldover.co.uk/wp-content
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504555]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/dev.boldover.co.uk/wp-config.php
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504560]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/dev.boldover.co.uk/.wp-toolkit-ignore
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504566]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/brighto1/dev.brightonhovelabour.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504571]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/devdev -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504577]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/jalbum/jeremy/public_html/Devon_2012 -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:56 nativespace-cdp sudo[3504581]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/dhyana/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504587]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/dhyana/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504591]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/dickemery123/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504596]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dickemery123/public_html/wp/wp-content
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504601]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dickemery123/public_html/wp/wp-config.php
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504606]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/dickemery123/public_html/wp/.wp-toolkit-ignore
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504611]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/home/ranxterc/websites/disfigurines -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504616]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/home/ranxterc/websites/disfigurines -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504621]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504627]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504632]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504637]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  8 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:57 nativespace-cdp sudo[3504642]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:58 nativespace-cdp sudo[3504648]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  8 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:58 nativespace-cdp sudo[3504654]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  8 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:58 nativespace-cdp sudo[3504659]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  8 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:58 nativespace-cdp sudo[3504664]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/dogmarket.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:58 nativespace-cdp sudo[3504669]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/dogmarket.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:58 nativespace-cdp sudo[3504674]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/beauty/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:58 nativespace-cdp sudo[3504679]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/carsinyo/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504685]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/clean/wp-content
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504696]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/clean/wp-config.php
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504701]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/clean/../wp-config.php
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504705]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/clean/../wp-includes
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504710]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/wp-content
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504715]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/wp-config.php
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504720]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/.wp-toolkit-ignore
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504726]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wp-content
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504732]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wp-config.php
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504737]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/.wp-toolkit-ignore
Sep  8 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:01:59 nativespace-cdp sudo[3504741]: pam_unix(sudo:session): session closed for user root
Sep  8 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/donnychicago/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504747]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/drutopia.co -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504753]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/drybrookband.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504757]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/drybrookband.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504763]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/drybrookband.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504768]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/drybrookband.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504774]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/dudley -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504778]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/wp-content
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504783]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/wp-config.php
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504788]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/.wp-toolkit-ignore
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:00 nativespace-cdp sudo[3504793]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/eacha.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:01 nativespace-cdp sudo[3504799]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/eacha.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:01 nativespace-cdp sudo[3504813]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/eacha.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:01 nativespace-cdp sudo[3504818]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/eatspam/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:01 nativespace-cdp sudo[3504823]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cathski/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:02 nativespace-cdp sudo[3504828]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/eugincou/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:02 nativespace-cdp sudo[3504833]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/fallgame.info -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:02 nativespace-cdp sudo[3504838]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/fancydresspiratecostumes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:02 nativespace-cdp sudo[3504844]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fawcettd/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:02 nativespace-cdp sudo[3504849]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/fellowshipofkilmarnockchurches.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:03 nativespace-cdp sudo[3504855]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/fellowshipofkilmarnockchurches.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:03 nativespace-cdp sudo[3504862]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fetch/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:03 nativespace-cdp sudo[3504868]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504872]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/wp-content
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504887]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/wp-config.php
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504891]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/altrincham/.wp-toolkit-ignore
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504896]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/wp-content
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504901]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/wp-config.php
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504906]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/birmingham/.wp-toolkit-ignore
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504911]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/wp-content
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504916]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/wp-config.php
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504921]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/blackburn/.wp-toolkit-ignore
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504926]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/wp-content
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504932]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/wp-config.php
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504936]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bolton/.wp-toolkit-ignore
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504941]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/wp-content
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504946]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/wp-config.php
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504952]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burnley/.wp-toolkit-ignore
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504957]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/wp-content
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504963]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/wp-config.php
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504968]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/burtonupontrent/.wp-toolkit-ignore
Sep  8 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:08 nativespace-cdp sudo[3504972]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3504978]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/wp-config.php
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3504983]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/bury/.wp-toolkit-ignore
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3504989]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3504994]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/wp-config.php
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505000]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/chorley/.wp-toolkit-ignore
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505004]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505011]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/wp-config.php
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505015]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/coventry/.wp-toolkit-ignore
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505021]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505026]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/wp-config.php
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505031]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/derby/.wp-toolkit-ignore
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505037]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505042]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/wp-config.php
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505047]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/dudley/.wp-toolkit-ignore
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505052]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505057]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/wp-config.php
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505061]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/.wp-toolkit-ignore
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505066]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505071]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/wp-config.php
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505076]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/.wp-toolkit-ignore
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505081]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505087]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/wp-config.php
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505092]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/.wp-toolkit-ignore
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505096]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505101]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/wp-config.php
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505106]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/.wp-toolkit-ignore
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505111]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/wp-content
Sep  8 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:09 nativespace-cdp sudo[3505116]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505121]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/.wp-toolkit-ignore
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505126]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/wp-content
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505132]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505137]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/.wp-toolkit-ignore
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505142]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/wp-content
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505147]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505152]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/.wp-toolkit-ignore
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505157]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/wp-content
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505162]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505167]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/.wp-toolkit-ignore
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505172]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/wp-content
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505178]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505182]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/.wp-toolkit-ignore
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505187]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/wp-content
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505192]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505197]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/.wp-toolkit-ignore
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505202]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/wp-content
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505207]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505212]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/.wp-toolkit-ignore
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505217]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/wp-content
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505222]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505227]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/.wp-toolkit-ignore
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505232]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/wp-content
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505237]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505242]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/.wp-toolkit-ignore
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505247]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/wp-content
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:10 nativespace-cdp sudo[3505252]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/wp-config.php
Sep  8 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505257]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/.wp-toolkit-ignore
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505262]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/wp-content
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505267]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/wp-config.php
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505273]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/.wp-toolkit-ignore
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505278]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/wp-content
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505283]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/wp-config.php
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505288]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/.wp-toolkit-ignore
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505293]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/wp-content
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505297]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/wp-config.php
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505303]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/.wp-toolkit-ignore
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505308]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/wp-content
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505313]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/wp-config.php
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505318]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/.wp-toolkit-ignore
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505324]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/wp-content
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505329]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/wp-config.php
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505335]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/.wp-toolkit-ignore
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505339]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/wp-content
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505345]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/wp-config.php
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505349]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/.wp-toolkit-ignore
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505355]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/wp-content
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505360]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/wp-config.php
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505365]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/.wp-toolkit-ignore
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505370]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/wp-content
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505375]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/wp-config.php
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505380]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/.wp-toolkit-ignore
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505385]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/wp-content
Sep  8 05:02:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:11 nativespace-cdp sudo[3505390]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/wp-config.php
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505395]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/.wp-toolkit-ignore
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505400]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/wp-content
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505406]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/wp-config.php
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505411]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/.wp-toolkit-ignore
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505416]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/wp-content
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505421]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/wp-config.php
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505426]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/.wp-toolkit-ignore
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505431]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/wp-content
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505437]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/wp-config.php
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505442]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/.wp-toolkit-ignore
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505447]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/wp-content
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505451]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/wp-config.php
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505458]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/.wp-toolkit-ignore
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505463]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/wp-content
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505468]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/wp-config.php
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505473]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/.wp-toolkit-ignore
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505478]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/wp-content
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505483]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/wp-config.php
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505488]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/.wp-toolkit-ignore
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505493]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/wp-content
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505498]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/wp-config.php
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505503]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/.wp-toolkit-ignore
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505508]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/wp-content
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505514]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/wp-config.php
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505518]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/.wp-toolkit-ignore
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505523]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/wp-content
Sep  8 05:02:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:12 nativespace-cdp sudo[3505529]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/wp-config.php
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505534]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/.wp-toolkit-ignore
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505539]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/wp-content
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505545]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/wp-config.php
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505549]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/.wp-toolkit-ignore
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505555]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/wp-content
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505560]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/wp-config.php
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505565]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/.wp-toolkit-ignore
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505570]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/wp-content
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505575]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/wp-config.php
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505581]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/.wp-toolkit-ignore
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505586]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/wp-content
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505591]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/wp-config.php
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505596]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/.wp-toolkit-ignore
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505601]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wp-content
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505606]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wp-config.php
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505612]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/.wp-toolkit-ignore
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505617]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstred/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:13 nativespace-cdp sudo[3505623]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstres/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505627]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstres/public_html/wp-content
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505633]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstres/public_html/wp-config.php
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505639]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstres/public_html/.wp-toolkit-ignore
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505644]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstrel/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505649]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre2/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505654]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre2/public_html/wp-content
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505663]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre2/public_html/wp-config.php
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505668]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre2/public_html/.wp-toolkit-ignore
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505673]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/fletcherjackson.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505677]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/fletcherjackson -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505683]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/fletcherjackson.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505688]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505693]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/wp-content
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505698]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/wp-config.php
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505703]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/blog/.wp-toolkit-ignore
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505706]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-content
Sep  8 05:02:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:14 nativespace-cdp sudo[3505712]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/wp-config.php
Sep  8 05:02:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:15 nativespace-cdp sudo[3505717]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/boldover/public_html/boldover-graphic-design.co.uk/.wp-toolkit-ignore
Sep  8 05:02:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:15 nativespace-cdp sudo[3505722]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/forestedgebenefice.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:15 nativespace-cdp sudo[3505727]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/forestedgebenefice.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:15 nativespace-cdp sudo[3505732]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/forestrc.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:15 nativespace-cdp sudo[3505737]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/forestrc.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:15 nativespace-cdp sudo[3505742]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/cath/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:15 nativespace-cdp sudo[3505747]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fortunaz/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:18 nativespace-cdp sudo[3505752]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/wp-content
Sep  8 05:02:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:18 nativespace-cdp sudo[3505767]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/wp-config.php
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505773]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/.wp-toolkit-ignore
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505777]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fortunaz/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505781]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/wp-content
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505786]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/wp-config.php
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505791]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/public_html/.wp-toolkit-ignore
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505796]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/gainford-inventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505804]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/gainford-inventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505808]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/getgotdelivered.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505813]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/getgotdelivered.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505818]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505823]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/asandcoc/public_html/global -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505829]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/grantham -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505834]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/wp-content
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505839]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/wp-config.php
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505844]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/grantham/.wp-toolkit-ignore
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505849]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/graydimensions.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505855]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/graydimensions.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505861]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/halfanedit -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:19 nativespace-cdp sudo[3505865]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/halifax -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:20 nativespace-cdp sudo[3505870]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/wp-content
Sep  8 05:02:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:20 nativespace-cdp sudo[3505875]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/wp-config.php
Sep  8 05:02:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:20 nativespace-cdp sudo[3505880]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/halifax/.wp-toolkit-ignore
Sep  8 05:02:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:20 nativespace-cdp sudo[3505885]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/harryclark.me.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:20 nativespace-cdp sudo[3505890]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/harryclark.me.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:20 nativespace-cdp sudo[3505895]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/havantho/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:21 nativespace-cdp sudo[3505901]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/health2045/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:21 nativespace-cdp sudo[3505908]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/health2045/public_html/wp-content
Sep  8 05:02:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:21 nativespace-cdp sudo[3505914]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/health2045/public_html/wp-config.php
Sep  8 05:02:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:21 nativespace-cdp sudo[3505919]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/health2045/public_html/.wp-toolkit-ignore
Sep  8 05:02:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:21 nativespace-cdp sudo[3505924]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/home/ranxterc/websites/hellositex -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:21 nativespace-cdp sudo[3505929]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/home/ranxterc/websites/hellositex -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:21 nativespace-cdp sudo[3505935]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/help -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:22 nativespace-cdp sudo[3505940]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/highlegh/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:24 nativespace-cdp sudo[3505945]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hirefootballgame/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:24 nativespace-cdp sudo[3505955]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hodgsonmail/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:24 nativespace-cdp sudo[3505960]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/homebuyinghelp.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:24 nativespace-cdp sudo[3505965]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/homebuyinghelp.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:24 nativespace-cdp sudo[3505970]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/mcdermos/public_html/homovision -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:24 nativespace-cdp sudo[3505975]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/wp-content
Sep  8 05:02:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:24 nativespace-cdp sudo[3505980]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/wp-config.php
Sep  8 05:02:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:24 nativespace-cdp sudo[3505985]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/.wp-toolkit-ignore
Sep  8 05:02:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:25 nativespace-cdp sudo[3505990]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/howardon/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:25 nativespace-cdp sudo[3505995]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/huddersfield -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:25 nativespace-cdp sudo[3506000]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/wp-content
Sep  8 05:02:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:25 nativespace-cdp sudo[3506005]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/wp-config.php
Sep  8 05:02:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:25 nativespace-cdp sudo[3506010]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/huddersfield/.wp-toolkit-ignore
Sep  8 05:02:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:25 nativespace-cdp sudo[3506015]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/hyperchro.me -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:25 nativespace-cdp sudo[3506021]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/wp-content
Sep  8 05:02:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:25 nativespace-cdp sudo[3506026]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/wp-config.php
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506031]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/.wp-toolkit-ignore
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506036]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/hyperchrome -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506041]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ianrayne/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506046]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/images -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506051]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/impactconsultancy.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506056]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/impactconsultancy.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506062]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/innovat1/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506067]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/innovat1/public_html/www -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506073]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/innovat1/public_html/www -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:26 nativespace-cdp sudo[3506078]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:32 nativespace-cdp sudo[3506083]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:32 nativespace-cdp sudo[3506104]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:32 nativespace-cdp sudo[3506109]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:32 nativespace-cdp sudo[3506114]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:32 nativespace-cdp sudo[3506119]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:32 nativespace-cdp sudo[3506124]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:32 nativespace-cdp sudo[3506129]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506133]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506139]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506144]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506149]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506154]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506159]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506164]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506170]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506175]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506180]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506185]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506190]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506196]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506201]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/inventory-pro.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506206]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/inventory-pro.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:33 nativespace-cdp sudo[3506212]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/ipadinventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:34 nativespace-cdp sudo[3506217]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/ipadinventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:34 nativespace-cdp sudo[3506221]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:34 nativespace-cdp sudo[3506226]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:34 nativespace-cdp sudo[3506235]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:34 nativespace-cdp sudo[3506240]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:34 nativespace-cdp sudo[3506245]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:34 nativespace-cdp sudo[3506249]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:34 nativespace-cdp sudo[3506255]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:34 nativespace-cdp sudo[3506260]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/irvinekilmarnockpresbytery.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:35 nativespace-cdp sudo[3506265]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/irvinekilmarnockpresbytery.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506271]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/isleofwi/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506276]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/isleofwi/public_html/wp-content
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506281]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/isleofwi/public_html/wp-config.php
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506286]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/isleofwi/public_html/.wp-toolkit-ignore
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506291]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/isleofwightguesthouse.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506296]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/isleofwightguesthouse.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506301]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506307]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506312]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/jarvisin/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:36 nativespace-cdp sudo[3506317]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/jennimil/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:37 nativespace-cdp sudo[3506322]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jennimil/public_html/wp-content
Sep  8 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:37 nativespace-cdp sudo[3506328]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jennimil/public_html/wp-config.php
Sep  8 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:37 nativespace-cdp sudo[3506333]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jennimil/public_html/.wp-toolkit-ignore
Sep  8 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:37 nativespace-cdp sudo[3506338]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/gilpin/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:37 nativespace-cdp sudo[3506344]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/jlive.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:37 nativespace-cdp sudo[3506348]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/jlive.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:37 nativespace-cdp sudo[3506354]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/jonhartl/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:38 nativespace-cdp sudo[3506358]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jonhartl/public_html/wp-content
Sep  8 05:02:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:38 nativespace-cdp sudo[3506364]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jonhartl/public_html/wp-config.php
Sep  8 05:02:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:38 nativespace-cdp sudo[3506369]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/jonhartl/public_html/../wp-config.php
Sep  8 05:02:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:38 nativespace-cdp sudo[3506375]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/joomla -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:38 nativespace-cdp sudo[3506381]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bemadonn/public_html/justbengals.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:38 nativespace-cdp sudo[3506385]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bemadonn/public_html/justbengals.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:38 nativespace-cdp sudo[3506390]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/kategilpin/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:45 nativespace-cdp sudo[3506395]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/katieclark.me.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:45 nativespace-cdp sudo[3506413]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/katieclark.me.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:45 nativespace-cdp sudo[3506418]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/kess2012.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:46 nativespace-cdp sudo[3506422]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/kess2012.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:46 nativespace-cdp sudo[3506432]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/kidderminster -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:46 nativespace-cdp sudo[3506436]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/wp-content
Sep  8 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:46 nativespace-cdp sudo[3506441]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/wp-config.php
Sep  8 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:46 nativespace-cdp sudo[3506446]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/kidderminster/.wp-toolkit-ignore
Sep  8 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:46 nativespace-cdp sudo[3506451]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/seftvta/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:46 nativespace-cdp sudo[3506457]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/jalbum/jeremy/public_html/Koro -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:46 nativespace-cdp sudo[3506463]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ladburyp/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506468]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/old/wp-content
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506474]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/old/wp-config.php
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506480]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/old/.wp-toolkit-ignore
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506485]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/wp-content
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506490]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/wp-config.php
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506494]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/old_site/.wp-toolkit-ignore
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506499]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/wp-content
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506504]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/wp-config.php
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506509]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ladburyp/public_html/.wp-toolkit-ignore
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506515]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lakesan1/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506521]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbscrmod/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:48 nativespace-cdp sudo[3506525]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:49 nativespace-cdp sudo[3506530]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ledburyfoodbank.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:49 nativespace-cdp sudo[3506536]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ledburyfoodbank.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:49 nativespace-cdp sudo[3506542]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/leereyn1/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:49 nativespace-cdp sudo[3506546]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506551]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506562]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506568]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506573]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506577]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506582]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506587]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506592]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506597]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506602]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:51 nativespace-cdp sudo[3506607]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  8 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506612]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506617]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506622]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506627]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506632]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506637]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506642]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506647]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506652]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/legorobotclub.co.ukPHP7 -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506657]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-content
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506663]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/wp-config.php
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506668]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/legorobotclub.co.ukPHP7/.wp-toolkit-ignore
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:52 nativespace-cdp sudo[3506673]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/legotest -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:54 nativespace-cdp sudo[3506678]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legotest/wp-content
Sep  8 05:02:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:54 nativespace-cdp sudo[3506691]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legotest/wp-config.php
Sep  8 05:02:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:54 nativespace-cdp sudo[3506696]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legotest/.wp-toolkit-ignore
Sep  8 05:02:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:54 nativespace-cdp sudo[3506701]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/leicester -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:54 nativespace-cdp sudo[3506706]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/wp-content
Sep  8 05:02:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:54 nativespace-cdp sudo[3506711]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/wp-config.php
Sep  8 05:02:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:54 nativespace-cdp sudo[3506716]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leicester/.wp-toolkit-ignore
Sep  8 05:02:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506722]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/leigh -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506727]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/wp-content
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506732]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/wp-config.php
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506737]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leigh/.wp-toolkit-ignore
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506742]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/leyland -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506747]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/wp-content
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506752]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/wp-config.php
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506757]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/leyland/.wp-toolkit-ignore
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506762]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/lichfield -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506767]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/wp-content
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506772]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/wp-config.php
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506777]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/lichfield/.wp-toolkit-ignore
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506782]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lkpier/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506787]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lkpier/public_html/wp-content
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506792]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lkpier/public_html/wp-config.php
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506797]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lkpier/public_html/.wp-toolkit-ignore
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506802]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oubpgvbx/public_html/link -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506808]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/live -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506812]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-services.co.uk/live -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506818]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeinventories.co.uk/live -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506823]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/lochard.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:55 nativespace-cdp sudo[3506828]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/lochard.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:56 nativespace-cdp sudo[3506833]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/lochard.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:56 nativespace-cdp sudo[3506838]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/lochard.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:56 nativespace-cdp sudo[3506843]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:56 nativespace-cdp sudo[3506848]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/wp-content
Sep  8 05:02:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:56 nativespace-cdp sudo[3506854]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/wp-config.php
Sep  8 05:02:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:56 nativespace-cdp sudo[3506859]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/.wp-toolkit-ignore
Sep  8 05:02:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:56 nativespace-cdp sudo[3506864]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:56 nativespace-cdp sudo[3506870]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/wp-content
Sep  8 05:02:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:57 nativespace-cdp sudo[3506874]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/wp-config.php
Sep  8 05:02:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:57 nativespace-cdp sudo[3506879]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/longbridgedeverillflowershow.co.uk/public_html/.wp-toolkit-ignore
Sep  8 05:02:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:57 nativespace-cdp sudo[3506884]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/loudounchurch.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:57 nativespace-cdp sudo[3506889]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html/loudounchurch.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:57 nativespace-cdp sudo[3506895]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/loughborough -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:58 nativespace-cdp sudo[3506899]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/wp-content
Sep  8 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:58 nativespace-cdp sudo[3506905]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/wp-config.php
Sep  8 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:58 nativespace-cdp sudo[3506910]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/loughborough/.wp-toolkit-ignore
Sep  8 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:58 nativespace-cdp sudo[3506916]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/legorobotclub/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506922]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/wp-content
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506929]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/wp-config.php
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506934]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/.wp-toolkit-ignore
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506939]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/macclesfield -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506943]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/wp-content
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506949]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/wp-config.php
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506957]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/macclesfield/.wp-toolkit-ignore
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506964]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/maflemin/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506970]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/magichat/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506974]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/manchester -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506980]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/wp-content
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506984]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/wp-config.php
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506989]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/manchester/.wp-toolkit-ignore
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3506994]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/mansfield -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3507000]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/wp-content
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3507004]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/wp-config.php
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3507010]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/mansfield/.wp-toolkit-ignore
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3507014]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/david/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3507020]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/markward/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:02:59 nativespace-cdp sudo[3507025]: pam_unix(sudo:session): session closed for user root
Sep  8 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/martsblo/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507030]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/mcdermos/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507035]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/wp-content
Sep  8 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507042]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/wp-config.php
Sep  8 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507047]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision/.wp-toolkit-ignore
Sep  8 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507052]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision_bak/wp-content
Sep  8 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507058]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision_bak/wp-config.php
Sep  8 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507063]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision_bak/../wp-config.php
Sep  8 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507068]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/homovision_bak/../wp-includes
Sep  8 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507072]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sam/wp-content
Sep  8 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:00 nativespace-cdp sudo[3507078]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sam/wp-config.php
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507082]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sam/../wp-config.php
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507086]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sam/../wp-includes
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507092]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/samco/wp-content
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507098]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/samco/wp-config.php
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507103]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/samco/.wp-toolkit-ignore
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507107]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-content
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507112]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-config.php
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507117]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/.wp-toolkit-ignore
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507123]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/wp-content
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507128]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/wp-config.php
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507133]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/.wp-toolkit-ignore
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507138]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/mcleanforth.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507142]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/mcleanforth.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507156]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/media/mediapeople.tv -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507161]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/megacards/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507167]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/middleeast-training.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507171]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/middleeast-training.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507176]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/midlands -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507181]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/wp-content
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507186]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/wp-config.php
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507190]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/midlands/.wp-toolkit-ignore
Sep  8 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:01 nativespace-cdp sudo[3507196]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:02 nativespace-cdp sudo[3507202]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/wp-content
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:02 nativespace-cdp sudo[3507209]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/wp-config.php
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:02 nativespace-cdp sudo[3507214]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/hyperchro.me/dev/wordpress/.wp-toolkit-ignore
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:02 nativespace-cdp sudo[3507219]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/wp-content
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:02 nativespace-cdp sudo[3507224]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/wp-config.php
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:02 nativespace-cdp sudo[3507229]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/.wp-toolkit-ignore
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:02 nativespace-cdp sudo[3507234]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/missfoxglove.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:02 nativespace-cdp sudo[3507239]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/modelsofdiversity.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:02 nativespace-cdp sudo[3507244]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/modelsofdiversity.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:04 nativespace-cdp sudo[3507250]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/mod2 -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:04 nativespace-cdp sudo[3507257]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/modelsofdiversity.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507263]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/modelsofdiversity.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507269]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/mod2 -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507274]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/monmouthmt.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507279]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/monmouthmt.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507284]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/stagingerris/public_html/montel.stagingerris.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507289]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html/moonmousecreative.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507295]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html/moonmousecreative.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507299]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/moraycoastescapes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507304]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/moraycoastescapes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507309]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/jalbum/jeremy/public_html/MP40 -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507315]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/muchbirchparish.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507320]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/muchbirchparish.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:05 nativespace-cdp sudo[3507325]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/musorguk/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:06 nativespace-cdp sudo[3507329]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/musorguk/public_html/teapot/wp-content
Sep  8 05:03:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:06 nativespace-cdp sudo[3507336]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/musorguk/public_html/teapot/wp-config.php
Sep  8 05:03:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:06 nativespace-cdp sudo[3507341]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/musorguk/public_html/teapot/.wp-toolkit-ignore
Sep  8 05:03:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:06 nativespace-cdp sudo[3507346]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/my -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:06 nativespace-cdp sudo[3507352]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nativene/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:06 nativespace-cdp sudo[3507357]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nstriton/public_html/nativespace-triton.ns-triton.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:06 nativespace-cdp sudo[3507361]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nbhavers/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:15 nativespace-cdp sudo[3507367]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/ndpwesthampstead.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:15 nativespace-cdp sudo[3507389]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/ndpwesthampstead.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:16 nativespace-cdp sudo[3507394]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/newnhamstpetersschool.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:16 nativespace-cdp sudo[3507399]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/newnhamstpetersschool.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:16 nativespace-cdp sudo[3507404]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/newstoda/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:17 nativespace-cdp sudo[3507409]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/newstoda/public_html/wp-content
Sep  8 05:03:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:17 nativespace-cdp sudo[3507415]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/newstoda/public_html/wp-config.php
Sep  8 05:03:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:17 nativespace-cdp sudo[3507420]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/newstoda/public_html/.wp-toolkit-ignore
Sep  8 05:03:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:17 nativespace-cdp sudo[3507425]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ninejimm/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:18 nativespace-cdp sudo[3507432]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ninejimm/public_html/wordpress/wp-content
Sep  8 05:03:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:18 nativespace-cdp sudo[3507438]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ninejimm/public_html/wordpress/wp-config.php
Sep  8 05:03:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:18 nativespace-cdp sudo[3507443]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ninejimm/public_html/wordpress/.wp-toolkit-ignore
Sep  8 05:03:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:18 nativespace-cdp sudo[3507448]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nomistakes/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507454]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/northshoresoftware.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507475]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/northshoresoftware.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507480]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/northwest -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507487]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/wp-content
Sep  8 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507491]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/wp-config.php
Sep  8 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507496]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/northwest/.wp-toolkit-ignore
Sep  8 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507501]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/nottingham -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507505]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/wp-content
Sep  8 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507512]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/wp-config.php
Sep  8 05:03:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:24 nativespace-cdp sudo[3507518]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nottingham/.wp-toolkit-ignore
Sep  8 05:03:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:25 nativespace-cdp sudo[3507523]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nove/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:25 nativespace-cdp sudo[3507528]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nove/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:25 nativespace-cdp sudo[3507535]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nscdp/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507540]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nsceres/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507545]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/nstriton/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507552]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/nuedesign.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507557]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/nuedesign.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507562]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/nuneaton -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507567]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/wp-content
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507572]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/wp-config.php
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507576]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/nuneaton/.wp-toolkit-ignore
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507582]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/milloyco/public_html/oddleberry.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507588]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/wp-content
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507592]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/wp-config.php
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507597]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/milloyco/public_html/oddleberry.com/.wp-toolkit-ignore
Sep  8 05:03:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:26 nativespace-cdp sudo[3507602]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/oldham -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507607]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/wp-content
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507612]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/wp-config.php
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507617]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/oldham/.wp-toolkit-ignore
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507622]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507627]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507632]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507638]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507643]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507647]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507652]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507657]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/outdoorc/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:27 nativespace-cdp sudo[3507662]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/outdoorc/public_html/wp-content
Sep  8 05:03:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:28 nativespace-cdp sudo[3507667]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/outdoorc/public_html/wp-config.php
Sep  8 05:03:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:28 nativespace-cdp sudo[3507672]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/outdoorc/public_html/.wp-toolkit-ignore
Sep  8 05:03:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:28 nativespace-cdp sudo[3507677]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/oxfraud -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:28 nativespace-cdp sudo[3507682]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/oxfraud2 -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:28 nativespace-cdp sudo[3507687]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/foods/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:29 nativespace-cdp sudo[3507692]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/alexadmin/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:29 nativespace-cdp sudo[3507705]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507710]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-content
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507766]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/wp-config.php
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507771]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/amcalenan/.wp-toolkit-ignore
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507779]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/mausblack.co.uk/wp-content
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507786]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/mausblack.co.uk/wp-config.php
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507792]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/mausblack.co.uk/.wp-toolkit-ignore
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507799]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/pmc-working/wp-content
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507806]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/pmc-working/wp-config.php
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507814]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/pmc-working/.wp-toolkit-ignore
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507819]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/sibylnutmeg/wp-content
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507824]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/sibylnutmeg/wp-config.php
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507832]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/sibylnutmeg/.wp-toolkit-ignore
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507839]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/test_cushion/wp-content
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507847]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/test_cushion/wp-config.php
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507852]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/test_cushion/.wp-toolkit-ignore
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507857]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-content
Sep  8 05:03:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:35 nativespace-cdp sudo[3507863]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-config.php
Sep  8 05:03:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:36 nativespace-cdp sudo[3507868]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/.wp-toolkit-ignore
Sep  8 05:03:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:36 nativespace-cdp sudo[3507877]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/wp-content
Sep  8 05:03:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:36 nativespace-cdp sudo[3507885]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/wp-config.php
Sep  8 05:03:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:36 nativespace-cdp sudo[3507889]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/.wp-toolkit-ignore
Sep  8 05:03:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:36 nativespace-cdp sudo[3507894]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/rubbishchristmas/wp-content
Sep  8 05:03:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:36 nativespace-cdp sudo[3507899]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/rubbishchristmas/wp-config.php
Sep  8 05:03:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:36 nativespace-cdp sudo[3507904]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/rubbishchristmas/.wp-toolkit-ignore
Sep  8 05:03:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:36 nativespace-cdp sudo[3507910]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/philmcph/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:37 nativespace-cdp sudo[3507919]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/philmcph/public_html/wp-content
Sep  8 05:03:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:37 nativespace-cdp sudo[3507948]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/philmcph/public_html/wp-config.php
Sep  8 05:03:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:37 nativespace-cdp sudo[3507953]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/philmcph/public_html/.wp-toolkit-ignore
Sep  8 05:03:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:37 nativespace-cdp sudo[3507958]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/photos.leadbetter.cc -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:37 nativespace-cdp sudo[3507964]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/photos.leadbetter.cc -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:37 nativespace-cdp sudo[3507969]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/php -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:37 nativespace-cdp sudo[3507975]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:38 nativespace-cdp sudo[3507979]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:38 nativespace-cdp sudo[3507984]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:38 nativespace-cdp sudo[3507990]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:38 nativespace-cdp sudo[3507994]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:38 nativespace-cdp sudo[3507999]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:38 nativespace-cdp sudo[3508004]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:38 nativespace-cdp sudo[3508009]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508014]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508024]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508029]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508034]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508039]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508044]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508049]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508053]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508061]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508066]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508071]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508076]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508082]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508087]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-ne.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508092]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-services.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:40 nativespace-cdp sudo[3508097]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:41 nativespace-cdp sudo[3508101]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:41 nativespace-cdp sudo[3508108]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:41 nativespace-cdp sudo[3508113]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:41 nativespace-cdp sudo[3508118]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:41 nativespace-cdp sudo[3508123]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:41 nativespace-cdp sudo[3508128]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:41 nativespace-cdp sudo[3508133]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:41 nativespace-cdp sudo[3508138]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508143]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508148]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508154]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508160]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508164]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508169]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-services.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508175]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe.pro -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508180]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe.pro -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508185]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe.services -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508190]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508196]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508201]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508206]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe.services -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508211]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508216]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508221]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508226]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/www.pinstripefranchise.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508231]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/www.pinstripefranchise.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:42 nativespace-cdp sudo[3508236]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeinventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:43 nativespace-cdp sudo[3508242]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:43 nativespace-cdp sudo[3508245]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:43 nativespace-cdp sudo[3508254]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:43 nativespace-cdp sudo[3508258]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:43 nativespace-cdp sudo[3508264]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:43 nativespace-cdp sudo[3508268]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:43 nativespace-cdp sudo[3508273]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:43 nativespace-cdp sudo[3508278]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508283]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508289]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508295]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508300]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508305]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508310]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508316]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeinventories.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508321]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeoffice.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508326]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeoffice.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508331]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508337]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:44 nativespace-cdp sudo[3508343]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508349]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508354]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508359]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508365]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508369]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508375]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508379]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508384]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508391]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508396]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508401]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:45 nativespace-cdp sudo[3508406]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508411]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508417]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508422]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508427]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508432]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508437]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508441]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeutilities.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508446]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripeutilities.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508452]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/fancydresspiratecostumes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508456]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/pinstripe-ne.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508461]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/portfolio -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508467]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/privatelandlordservices.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508471]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/privatelandlordservices.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508477]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508482]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/emma.care -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508487]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/emma.care -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508491]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ralphbarnes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:46 nativespace-cdp sudo[3508496]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/ralphbarnes.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508502]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/randomclub.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508507]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/boldover/public_html/randomclub.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508512]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508516]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508522]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/redcaffeine.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508527]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/redcaffeine.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508532]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/redziller.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508538]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/redziller.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508542]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/reliable/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:47 nativespace-cdp sudo[3508548]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ptkxhsbt/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:50 nativespace-cdp sudo[3508553]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508566]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/rhinoinstalls.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508572]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/rhinoinstalls.net -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508577]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/rhinoinstalls.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508582]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/elecleis/rhinoinstalls.net -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508586]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ultbcrra/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508592]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ulsukarm/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508597]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ulsukarm/public_html/wp-content
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508602]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/rochdale -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508608]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/wp-content
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508612]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/wp-config.php
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508617]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rochdale/.wp-toolkit-ignore
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508623]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/romaldki/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:52 nativespace-cdp sudo[3508628]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ulsukarm/rtadevelopment.robert-taylor.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508633]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ulsukarm/rtadevelopment.robert-taylor.co.uk/wp-content
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508638]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ulsukarm/rtadevelopment.robert-taylor.co.uk/wp-config.php
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508644]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/ulsukarm/rtadevelopment.robert-taylor.co.uk/.wp-toolkit-ignore
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508649]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/rugby -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508655]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/wp-content
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508660]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/wp-config.php
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508664]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/rugby/.wp-toolkit-ignore
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508669]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/sale -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508673]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/wp-content
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508679]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/wp-config.php
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508684]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/sale/.wp-toolkit-ignore
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508689]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/salford -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508694]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/wp-content
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508699]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/wp-config.php
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508704]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/salford/.wp-toolkit-ignore
Sep  8 05:03:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:53 nativespace-cdp sudo[3508709]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/mcdermos/public_html/sams -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:54 nativespace-cdp sudo[3508714]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-content
Sep  8 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:54 nativespace-cdp sudo[3508718]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-config.php
Sep  8 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:54 nativespace-cdp sudo[3508725]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/.wp-toolkit-ignore
Sep  8 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:54 nativespace-cdp sudo[3508730]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/branko/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:54 nativespace-cdp sudo[3508735]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sarafoundation/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:58 nativespace-cdp sudo[3508740]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/zebrapho/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:58 nativespace-cdp sudo[3508756]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/savethealliance.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:58 nativespace-cdp sudo[3508761]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ggaaorgu/public_html/savethealliance.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:58 nativespace-cdp sudo[3508766]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/schlossrothenburg.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:58 nativespace-cdp sudo[3508771]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/schlossrothenburg.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:58 nativespace-cdp sudo[3508776]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/smrszyqg/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:58 nativespace-cdp sudo[3508781]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/severnvaledeanery.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:58 nativespace-cdp sudo[3508787]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/severnvaledeanery.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508792]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/severnwyema.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508797]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/severnwyema.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508802]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/shiningpyramid.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508807]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/shiningpyramid.org -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508812]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508817]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/sibtoncc -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508821]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sibtoncc/public_html/sibtoncc -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508827]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/sinclairmanagement -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508832]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/sindencox-art.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508837]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/sindencox-art.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:03:59 nativespace-cdp sudo[3508846]: pam_unix(sudo:session): session closed for user root
Sep  8 05:03:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sketchy/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:03:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508851]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508857]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/skyfire-designs.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508864]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/skyfire-designs.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508870]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/smitrod.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508875]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/smitrod.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508880]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/solihull -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508885]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/wp-content
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508890]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/wp-config.php
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508895]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/solihull/.wp-toolkit-ignore
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:00 nativespace-cdp sudo[3508901]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ptkxhsbt/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508906]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hodgesonweb/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508911]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/mcdermos/public_html/sams/wp -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508916]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-content
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508921]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/wp-config.php
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508926]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/mcdermos/public_html/sams/wp/.wp-toolkit-ignore
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508931]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/sosevalu/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508936]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/southlon/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508950]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/southwestbrassbandassociation.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508955]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/southwestbrassbandassociation.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:01 nativespace-cdp sudo[3508960]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/spectrum/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3508965]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/spectrum/public_html/blog/wp-content
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3508971]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/spectrum/public_html/blog/wp-config.php
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3508976]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/spectrum/public_html/blog/.wp-toolkit-ignore
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3508981]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/stafford -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3508986]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/wp-content
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3508991]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/wp-config.php
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3508996]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stafford/.wp-toolkit-ignore
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3509001]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/legorobotclub/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3509006]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/wp-content
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3509011]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/wp-config.php
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3509016]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/legorobotclub/public_html/.wp-toolkit-ignore
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:02 nativespace-cdp sudo[3509022]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/stagingerris/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:05 nativespace-cdp sudo[3509028]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/starwigs_2.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:05 nativespace-cdp sudo[3509044]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html/starwigs_2.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:06 nativespace-cdp sudo[3509050]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/careers/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/careers/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:06 nativespace-cdp sudo[3509055]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/bakery/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:11 nativespace-cdp sudo[3509059]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/careers/wp-content
Sep  8 05:04:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:11 nativespace-cdp sudo[3509085]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/careers/wp-config.php
Sep  8 05:04:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:11 nativespace-cdp sudo[3509090]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/careers/.wp-toolkit-ignore
Sep  8 05:04:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:11 nativespace-cdp sudo[3509095]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-content/themes/lcars/ctemp/steakbridie.careers/wp-content
Sep  8 05:04:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:11 nativespace-cdp sudo[3509101]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-content/themes/lcars/ctemp/steakbridie.careers/wp-config.php
Sep  8 05:04:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:11 nativespace-cdp sudo[3509106]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-content/themes/lcars/ctemp/steakbridie.careers/../wp-config.php
Sep  8 05:04:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:11 nativespace-cdp sudo[3509111]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-content
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:12 nativespace-cdp sudo[3509118]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/wp-config.php
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:12 nativespace-cdp sudo[3509122]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/.wp-toolkit-ignore
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:12 nativespace-cdp sudo[3509127]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/steakbridieme/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:12 nativespace-cdp sudo[3509133]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lucy/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:12 nativespace-cdp sudo[3509138]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/steve/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:12 nativespace-cdp sudo[3509143]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/steve/public_html/wp-content
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:12 nativespace-cdp sudo[3509149]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/steve/public_html/wp-config.php
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:12 nativespace-cdp sudo[3509154]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/steve/public_html/.wp-toolkit-ignore
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:12 nativespace-cdp sudo[3509159]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/foundation/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509164]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/foundation/public_html/wp-content
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509180]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/foundation/public_html/wp-config.php
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509185]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/foundation/public_html/.wp-toolkit-ignore
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509190]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hubmaster/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509195]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509199]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/stmichaelmitcheldean.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509204]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/stmichaelmitcheldean.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509210]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/stockport -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509214]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/wp-content
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509219]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/wp-config.php
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509224]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stockport/.wp-toolkit-ignore
Sep  8 05:04:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:15 nativespace-cdp sudo[3509229]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/stoke -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509235]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/wp-content
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509239]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/wp-config.php
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509244]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/stoke/.wp-toolkit-ignore
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509249]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/store -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509255]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509260]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/strathard.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509266]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/strathar/public_html/strathard.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509271]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/stroud-deanery.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509276]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/stroud-deanery.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509281]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/stuartge/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:16 nativespace-cdp sudo[3509286]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/sturgessbarns/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:17 nativespace-cdp sudo[3509290]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/sturgessbarns/public_html/wp-content
Sep  8 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:17 nativespace-cdp sudo[3509295]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/sturgessbarns/public_html/wp-config.php
Sep  8 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:17 nativespace-cdp sudo[3509300]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/sturgessbarns/public_html/.wp-toolkit-ignore
Sep  8 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:17 nativespace-cdp sudo[3509305]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/sturgessbarns.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:18 nativespace-cdp sudo[3509310]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/wp-content
Sep  8 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:18 nativespace-cdp sudo[3509317]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/wp-config.php
Sep  8 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:18 nativespace-cdp sudo[3509322]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/.wp-toolkit-ignore
Sep  8 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:18 nativespace-cdp sudo[3509328]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/sturgessbarns.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:18 nativespace-cdp sudo[3509333]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/wp-content
Sep  8 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:18 nativespace-cdp sudo[3509337]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/wp-config.php
Sep  8 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:18 nativespace-cdp sudo[3509342]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/sturgessbarns.co.uk/.wp-toolkit-ignore
Sep  8 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:18 nativespace-cdp sudo[3509347]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/superbstuff.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:18 nativespace-cdp sudo[3509352]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/superbstuff.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509357]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/havantho/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509362]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/suttoncoldfield -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509367]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/wp-content
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509372]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/wp-config.php
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509377]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/suttoncoldfield/.wp-toolkit-ignore
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509382]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/swbba.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509387]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/swbba.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509392]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/tamworth -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509398]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/wp-content
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509404]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/wp-config.php
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509409]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/tamworth/.wp-toolkit-ignore
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509414]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/tdcc-online.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509419]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/tdcc-online.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509424]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/tenancy-deposit-scheme-scotland.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509432]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:19 nativespace-cdp sudo[3509436]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-content
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509444]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/wp-config.php
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509449]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/.wp-toolkit-ignore
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509454]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-content
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509459]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/wp-config.php
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509464]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/oneoarco/public_html/pinstripe.services/.wp-toolkit-ignore
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509469]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/telford -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509474]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/wp-content
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509479]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/wp-config.php
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509484]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/telford/.wp-toolkit-ignore
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509489]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/temperaturemonitor.info -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509494]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/clarkass/public_html/temperaturemonitor.info -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509499]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/tenancy-deposit-scheme-scotland.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509505]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/public_html/ranxtertest -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509509]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/seftvta/public_html/test -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509514]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oubpgvbx/public_html/testlink -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509519]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/atestord/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509524]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/theblack/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509529]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/thedogmarket.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509534]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/thedogmarket.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509539]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/Thegooddogshop.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509545]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/Thegooddogshop.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509550]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/thegooddogshop.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:20 nativespace-cdp sudo[3509555]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/thegooddogshop.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509560]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/hidden/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509565]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/hidden/public_html/wp-content
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509570]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/hidden/public_html/wp-config.php
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509575]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/hidden/public_html/../wp-config.php
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509580]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/seftvta/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509585]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/leftie/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509591]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/leftie/public_html/wp-content
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509595]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/leftie/public_html/wp-config.php
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509600]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/leftie/public_html/../wp-config.php
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509605]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/thelordslarder.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509610]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/thelordslarder.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509615]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/thenorthseashore.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509620]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/thenorthseashore.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509625]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/thesevernforum.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509630]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/thesevernforum.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509636]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/still/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:21 nativespace-cdp sudo[3509641]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tigerlet/tigerestates.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509646]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tigerlet/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509651]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tigerlet/public_html/tigermanagement.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509656]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tigerlet/public_html/tigermetre.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509661]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/tomandle/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509666]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/touchinventories.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509671]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/touchinventories.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509676]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/touchis.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509681]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/touchis.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509686]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/traddad -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509691]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509696]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509701]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509706]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/traddad -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509712]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-content
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509716]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/wp-config.php
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509721]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/chrisdal/public_html/traddad/.wp-toolkit-ignore
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509726]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/trafford -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509731]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/wp-content
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509736]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/wp-config.php
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509741]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/trafford/.wp-toolkit-ignore
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509747]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/training-middleeast.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509752]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/training-middleeast.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:22 nativespace-cdp sudo[3509758]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html/traversingthehinterland.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:23 nativespace-cdp sudo[3509763]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-content
Sep  8 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:23 nativespace-cdp sudo[3509769]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-config.php
Sep  8 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:23 nativespace-cdp sudo[3509774]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/.wp-toolkit-ignore
Sep  8 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:23 nativespace-cdp sudo[3509779]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/paulmca1/public_html/traversingthehinterland.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:23 nativespace-cdp sudo[3509784]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-content
Sep  8 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:23 nativespace-cdp sudo[3509789]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/wp-config.php
Sep  8 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:23 nativespace-cdp sudo[3509794]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/paulmca1/public_html/traversingthehinterland.co.uk/.wp-toolkit-ignore
Sep  8 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:23 nativespace-cdp sudo[3509799]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fortunaz/trendytiles.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:26 nativespace-cdp sudo[3509804]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/wp-content
Sep  8 05:04:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:26 nativespace-cdp sudo[3509818]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/wp-config.php
Sep  8 05:04:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:26 nativespace-cdp sudo[3509823]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/.wp-toolkit-ignore
Sep  8 05:04:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:26 nativespace-cdp sudo[3509829]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/fortunaz/trendytiles.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:26 nativespace-cdp sudo[3509835]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/wp-content
Sep  8 05:04:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:26 nativespace-cdp sudo[3509839]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/wp-config.php
Sep  8 05:04:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:26 nativespace-cdp sudo[3509843]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/fortunaz/trendytiles.com/.wp-toolkit-ignore
Sep  8 05:04:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:26 nativespace-cdp sudo[3509849]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/subdomains/trixietrapp -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509855]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/trixietrapp/wp-content
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509860]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/trixietrapp/wp-config.php
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509865]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/subdomains/trixietrapp/.wp-toolkit-ignore
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509870]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/ukdrivingroads.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509875]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/chrisdal/public_html/ukdrivingroads.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509881]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/ranxterc/ranxter-upload -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509886]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/oneoarco/public_html/users -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509891]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vantagep/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509896]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/vivienn1/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509901]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/walkden -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509906]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/wp-content
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509911]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/wp-config.php
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509915]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walkden/.wp-toolkit-ignore
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:27 nativespace-cdp sudo[3509921]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/crrtipdl/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509926]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/crrtipdl/public_html/wp-content
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509932]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/crrtipdl/public_html/wp-config.php
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509937]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/crrtipdl/public_html/.wp-toolkit-ignore
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509942]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/walsall -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509947]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/wp-content
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509952]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/wp-config.php
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509957]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/walsall/.wp-toolkit-ignore
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509962]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/warrington -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509967]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/wp-content
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509972]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/wp-config.php
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509977]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/warrington/.wp-toolkit-ignore
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509982]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/carsinyo/public_html/wavs.co -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509987]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/wp-content
Sep  8 05:04:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:28 nativespace-cdp sudo[3509992]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/wp-config.php
Sep  8 05:04:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:29 nativespace-cdp sudo[3509997]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/carsinyo/public_html/wavs.co/.wp-toolkit-ignore
Sep  8 05:04:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:29 nativespace-cdp sudo[3510002]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/webba.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:29 nativespace-cdp sudo[3510007]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/webba.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:29 nativespace-cdp sudo[3510012]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/lbhyisi/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:30 nativespace-cdp sudo[3510017]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lbhyisi/public_html/redziller.co.uk 2fe6b75f-1b22-45ab-928d-6683b177d2fe55/blog/wp-content
Sep  8 05:04:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:30 nativespace-cdp sudo[3510031]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lbhyisi/public_html/redziller.co.uk 2fe6b75f-1b22-45ab-928d-6683b177d2fe55/blog/wp-config.php
Sep  8 05:04:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:30 nativespace-cdp sudo[3510036]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/lbhyisi/public_html/redziller.co.uk 2fe6b75f-1b22-45ab-928d-6683b177d2fe55/blog/.wp-toolkit-ignore
Sep  8 05:04:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:30 nativespace-cdp sudo[3510041]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/werefoxproductions.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510046]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/wp-content
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510055]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/wp-config.php
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510060]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/.wp-toolkit-ignore
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510065]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/pugwash/domains/werefoxproductions.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510070]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/wp-content
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510075]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/wp-config.php
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510080]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/pugwash/domains/werefoxproductions.com/.wp-toolkit-ignore
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510085]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/what/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510090]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/widnes -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510097]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/wp-content
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510103]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/wp-config.php
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510109]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/widnes/.wp-toolkit-ignore
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510114]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/wigan -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:31 nativespace-cdp sudo[3510121]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/wp-content
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510125]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/wp-config.php
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510130]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wigan/.wp-toolkit-ignore
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510135]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/wilsonleo.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510141]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html/wilsonleo.com -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510145]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510150]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/wilsonsw/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510155]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/outdoorc/public_html/windkatcowls.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510161]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/windwhistlewarren.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510166]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/skyfirec/public_html/windwhistlewarren.org.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510170]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/winsfordhouseproduce.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510176]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/athenare/public_html/winsfordhouseproduce.co.uk -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510180]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/wolverhampton -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510185]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/wp-content
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510191]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/wp-config.php
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510196]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/wolverhampton/.wp-toolkit-ignore
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510202]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/firstre5/public_html/worcester -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510207]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/wp-content
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510211]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/wp-config.php
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510216]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/firstre5/public_html/worcester/.wp-toolkit-ignore
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510221]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/zebrapho/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510226]: pam_unix(sudo:session): session closed for user root
Sep  8 05:04:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c find -H /home/zebrapho/public_html -type d -name wp-includes -printf '%h\0'
Sep  8 05:04:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:04:32 nativespace-cdp sudo[3510233]: pam_unix(sudo:session): session closed for user root
Sep  8 05:06:35 nativespace-cdp sshd[3510683]: Connection closed by 159.100.136.21 port 50886 [preauth]
Sep  8 05:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 05:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:38 nativespace-cdp sudo[3511284]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 05:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:38 nativespace-cdp sudo[3511288]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 05:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:38 nativespace-cdp sudo[3511293]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 05:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:38 nativespace-cdp sudo[3511300]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 05:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:42 nativespace-cdp sudo[3511306]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 05:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:42 nativespace-cdp sudo[3511325]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 05:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:42 nativespace-cdp sudo[3511330]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 05:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:42 nativespace-cdp sudo[3511335]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 05:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:42 nativespace-cdp sudo[3511340]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 05:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:42 nativespace-cdp sudo[3511346]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 05:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:42 nativespace-cdp sudo[3511351]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 05:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:47 nativespace-cdp sudo[3511368]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 05:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:48 nativespace-cdp sudo[3511374]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=wilsonsw user-2=musorguk user-3=megacards user-4=lakesan1 user-5=brmrjxl user-6=strathar user-7=sarafoundation user-8=atestord user-9=lbhyisi user-10=hhdugcor user-11=magichat user-12=martsblo user-13=dickemery123 user-14=ptkxhsbt user-15=ulsukarm user-16=booff user-17=markward user-18=foundation user-19=athenare user-20=connect9 user-21=vantagep user-22=maflemin user-23=lbscrmod user-24=still user-25=agproduc user-26=stephani user-27=leereyn1 user-28=jarvisin user-29=spectrum user-30=theblack user-31=hodgesonweb user-32=bedfords user-33=ggaaorgu user-34=belle user-35=newstoda user-36=bemadonn user-37=brighto1 user-38=nstriton user-39=firstre2 user-40=vivienn1 user-41=battlere user-42=oneoarco user-43=innovat1 user-44=askhform user-45=stuartge user-46=nativene user-47=skyfirec user-48=alexadmin
Sep  8 05:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstrel user-50=clarkass user-51=costestimatorco user-52=firstred user-53=southlon user-54=highlegh user-55=seftvta user-56=jonhartl user-57=ultbcrra user-58=firstres user-59=coursemc user-60=opaiscyx user-61=accooper user-62=ianrayne user-63=connectedshoppin user-64=thqkgnbz user-65=milloyco user-66=gilpin user-67=elecleis user-68=putterfi user-69=hubmaster user-70=carsinyo user-71=fetch user-72=isleofwi user-73=smrszyqg user-74=hidden user-75=nomistakes user-76=tigerlet user-77=barbersh user-78=putterfc user-79=nscdp user-80=fortunaz user-81=health2045 user-82=foods user-83=leftie user-84=lkpier user-85=ctedorgu user-86=philmcph user-87=donnychicago user-88=firstre5 user-89=steakbridieme user-90=hirefootballgame user-91=eugincou user-92=courseme user-93=cambria1 user-94=cathski user-95=reliable user-96=ninejimm user-97=pugwash user-98=howardon user-99=paulmca1 user-100=cwsocial user-101=bwppodcast
Sep  8 05:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=zebrapho user-103=steve user-104=asandcoc user-105=sibtoncc user-106=beauty user-107=eatspam user-108=darkstar user-109=dhyana user-110=burydropin user-111=fawcettd user-112=nsceres user-113=bakery user-114=sosevalu user-115=crrtipdl user-116=nove user-117=boldover user-118=ladburyp user-119=stagingerris user-120=dancinggardener user-121=kategilpin user-122=design user-123=tstardom user-124=oubpgvbx user-125=what user-126=sketchy user-127=cath user-128=havantho user-129=nvihkvu user-130=chrisdal user-131=mcdermos user-132=careers user-133=nbhavers user-134=david user-135=tomandle user-136=jennimil user-137=hodgsonmail user-138=ranxterc user-139=outdoorc user-140=branko user-141=romaldki user-142=attlebor user-143=lucy user-144=onlycont feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 05:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:48 nativespace-cdp sudo[3511382]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:48 nativespace-cdp sudo[3511388]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ml7mRm2t91d2wDoT.~
Sep  8 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:49 nativespace-cdp sudo[3511393]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ml7mRm2t91d2wDoT.~'
Sep  8 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:49 nativespace-cdp sudo[3511397]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ml7mRm2t91d2wDoT.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:49 nativespace-cdp sudo[3511404]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:49 nativespace-cdp sudo[3511410]: pam_unix(sudo:session): session closed for user root
Sep  8 05:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 05:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 05:09:51 nativespace-cdp sudo[3511433]: pam_unix(sudo:session): session closed for user root
Sep  8 05:11:33 nativespace-cdp sshd[3511915]: Connection closed by 159.100.136.21 port 59896 [preauth]
Sep  8 05:16:34 nativespace-cdp sshd[3513090]: Connection closed by 159.100.136.21 port 41168 [preauth]
Sep  8 05:21:34 nativespace-cdp sshd[3514078]: Connection closed by 159.100.136.21 port 50072 [preauth]
Sep  8 05:26:33 nativespace-cdp sshd[3515196]: Connection closed by 159.100.136.21 port 58998 [preauth]
Sep  8 05:31:33 nativespace-cdp sshd[3516197]: Connection closed by 159.100.136.21 port 39238 [preauth]
Sep  8 05:34:54 nativespace-cdp sshd[3516772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.103.153  user=root
Sep  8 05:34:54 nativespace-cdp sshd[3516772]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 05:34:55 nativespace-cdp sshd[3516772]: Failed password for root from 134.122.103.153 port 55904 ssh2
Sep  8 05:34:55 nativespace-cdp sshd[3516772]: Received disconnect from 134.122.103.153 port 55904:11: Bye Bye [preauth]
Sep  8 05:34:55 nativespace-cdp sshd[3516772]: Disconnected from 134.122.103.153 port 55904 [preauth]
Sep  8 05:35:08 nativespace-cdp su: pam_unix(su:session): session opened for user darkstar by (uid=0)
Sep  8 05:35:08 nativespace-cdp su[3516932]: pam_unix(su:session): session closed for user darkstar
Sep  8 05:35:53 nativespace-cdp sshd[3517067]: Invalid user advantage from 34.92.198.176 port 59390
Sep  8 05:35:53 nativespace-cdp sshd[3517067]: input_userauth_request: invalid user advantage [preauth]
Sep  8 05:35:53 nativespace-cdp sshd[3517067]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 05:35:53 nativespace-cdp sshd[3517067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.198.176
Sep  8 05:35:55 nativespace-cdp sshd[3517067]: Failed password for invalid user advantage from 34.92.198.176 port 59390 ssh2
Sep  8 05:35:55 nativespace-cdp sshd[3517067]: Received disconnect from 34.92.198.176 port 59390:11: Bye Bye [preauth]
Sep  8 05:35:55 nativespace-cdp sshd[3517067]: Disconnected from 34.92.198.176 port 59390 [preauth]
Sep  8 05:36:08 nativespace-cdp sshd[3517163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.174.245  user=root
Sep  8 05:36:08 nativespace-cdp sshd[3517163]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 05:36:10 nativespace-cdp sshd[3517163]: Failed password for root from 209.97.174.245 port 55626 ssh2
Sep  8 05:36:10 nativespace-cdp sshd[3517163]: Received disconnect from 209.97.174.245 port 55626:11: Bye Bye [preauth]
Sep  8 05:36:10 nativespace-cdp sshd[3517163]: Disconnected from 209.97.174.245 port 55626 [preauth]
Sep  8 05:36:33 nativespace-cdp sshd[3517230]: Connection closed by 159.100.136.21 port 48514 [preauth]
Sep  8 05:37:12 nativespace-cdp sshd[3517300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.118.142.216  user=root
Sep  8 05:37:12 nativespace-cdp sshd[3517300]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 05:37:14 nativespace-cdp sshd[3517300]: Failed password for root from 186.118.142.216 port 42236 ssh2
Sep  8 05:37:14 nativespace-cdp sshd[3517300]: Received disconnect from 186.118.142.216 port 42236:11: Bye Bye [preauth]
Sep  8 05:37:14 nativespace-cdp sshd[3517300]: Disconnected from 186.118.142.216 port 42236 [preauth]
Sep  8 05:40:50 nativespace-cdp sshd[3518159]: Invalid user blue from 134.122.103.153 port 46856
Sep  8 05:40:50 nativespace-cdp sshd[3518159]: input_userauth_request: invalid user blue [preauth]
Sep  8 05:40:50 nativespace-cdp sshd[3518159]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 05:40:50 nativespace-cdp sshd[3518159]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.103.153
Sep  8 05:40:52 nativespace-cdp sshd[3518159]: Failed password for invalid user blue from 134.122.103.153 port 46856 ssh2
Sep  8 05:40:52 nativespace-cdp sshd[3518159]: Received disconnect from 134.122.103.153 port 46856:11: Bye Bye [preauth]
Sep  8 05:40:52 nativespace-cdp sshd[3518159]: Disconnected from 134.122.103.153 port 46856 [preauth]
Sep  8 05:41:03 nativespace-cdp sshd[3518193]: Invalid user almalinux from 186.118.142.216 port 48468
Sep  8 05:41:03 nativespace-cdp sshd[3518193]: input_userauth_request: invalid user almalinux [preauth]
Sep  8 05:41:03 nativespace-cdp sshd[3518193]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 05:41:03 nativespace-cdp sshd[3518193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.118.142.216
Sep  8 05:41:05 nativespace-cdp sshd[3518193]: Failed password for invalid user almalinux from 186.118.142.216 port 48468 ssh2
Sep  8 05:41:05 nativespace-cdp sshd[3518193]: Received disconnect from 186.118.142.216 port 48468:11: Bye Bye [preauth]
Sep  8 05:41:05 nativespace-cdp sshd[3518193]: Disconnected from 186.118.142.216 port 48468 [preauth]
Sep  8 05:41:26 nativespace-cdp sshd[3518235]: Invalid user shashi from 34.92.198.176 port 55524
Sep  8 05:41:26 nativespace-cdp sshd[3518235]: input_userauth_request: invalid user shashi [preauth]
Sep  8 05:41:26 nativespace-cdp sshd[3518235]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 05:41:26 nativespace-cdp sshd[3518235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.198.176
Sep  8 05:41:28 nativespace-cdp sshd[3518235]: Failed password for invalid user shashi from 34.92.198.176 port 55524 ssh2
Sep  8 05:41:28 nativespace-cdp sshd[3518235]: Received disconnect from 34.92.198.176 port 55524:11: Bye Bye [preauth]
Sep  8 05:41:28 nativespace-cdp sshd[3518235]: Disconnected from 34.92.198.176 port 55524 [preauth]
Sep  8 05:41:32 nativespace-cdp sshd[3518296]: Invalid user sysman from 134.122.103.153 port 49178
Sep  8 05:41:32 nativespace-cdp sshd[3518296]: input_userauth_request: invalid user sysman [preauth]
Sep  8 05:41:32 nativespace-cdp sshd[3518296]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 05:41:32 nativespace-cdp sshd[3518296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.103.153
Sep  8 05:41:32 nativespace-cdp sshd[3518288]: Invalid user integra from 209.97.174.245 port 43984
Sep  8 05:41:32 nativespace-cdp sshd[3518288]: input_userauth_request: invalid user integra [preauth]
Sep  8 05:41:32 nativespace-cdp sshd[3518288]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 05:41:32 nativespace-cdp sshd[3518288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.174.245
Sep  8 05:41:33 nativespace-cdp sshd[3518316]: Connection closed by 159.100.136.21 port 57200 [preauth]
Sep  8 05:41:34 nativespace-cdp sshd[3518296]: Failed password for invalid user sysman from 134.122.103.153 port 49178 ssh2
Sep  8 05:41:34 nativespace-cdp sshd[3518296]: Received disconnect from 134.122.103.153 port 49178:11: Bye Bye [preauth]
Sep  8 05:41:34 nativespace-cdp sshd[3518296]: Disconnected from 134.122.103.153 port 49178 [preauth]
Sep  8 05:41:34 nativespace-cdp sshd[3518288]: Failed password for invalid user integra from 209.97.174.245 port 43984 ssh2
Sep  8 05:41:34 nativespace-cdp sshd[3518288]: Received disconnect from 209.97.174.245 port 43984:11: Bye Bye [preauth]
Sep  8 05:41:34 nativespace-cdp sshd[3518288]: Disconnected from 209.97.174.245 port 43984 [preauth]
Sep  8 05:41:50 nativespace-cdp sshd[3518600]: Invalid user jenkins from 186.118.142.216 port 45920
Sep  8 05:41:50 nativespace-cdp sshd[3518600]: input_userauth_request: invalid user jenkins [preauth]
Sep  8 05:41:50 nativespace-cdp sshd[3518600]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 05:41:50 nativespace-cdp sshd[3518600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.118.142.216
Sep  8 05:41:52 nativespace-cdp sshd[3518600]: Failed password for invalid user jenkins from 186.118.142.216 port 45920 ssh2
Sep  8 05:42:07 nativespace-cdp sshd[3518676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.198.176  user=root
Sep  8 05:42:07 nativespace-cdp sshd[3518676]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 05:42:09 nativespace-cdp sshd[3518676]: Failed password for root from 34.92.198.176 port 47824 ssh2
Sep  8 05:42:09 nativespace-cdp sshd[3518676]: Received disconnect from 34.92.198.176 port 47824:11: Bye Bye [preauth]
Sep  8 05:42:09 nativespace-cdp sshd[3518676]: Disconnected from 34.92.198.176 port 47824 [preauth]
Sep  8 05:42:29 nativespace-cdp sshd[3518754]: Invalid user rootadmin from 209.97.174.245 port 34502
Sep  8 05:42:29 nativespace-cdp sshd[3518754]: input_userauth_request: invalid user rootadmin [preauth]
Sep  8 05:42:29 nativespace-cdp sshd[3518754]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 05:42:29 nativespace-cdp sshd[3518754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.174.245
Sep  8 05:42:30 nativespace-cdp sshd[3518754]: Failed password for invalid user rootadmin from 209.97.174.245 port 34502 ssh2
Sep  8 05:42:30 nativespace-cdp sshd[3518754]: Received disconnect from 209.97.174.245 port 34502:11: Bye Bye [preauth]
Sep  8 05:42:30 nativespace-cdp sshd[3518754]: Disconnected from 209.97.174.245 port 34502 [preauth]
Sep  8 05:46:33 nativespace-cdp sshd[3519755]: Connection closed by 159.100.136.21 port 38674 [preauth]
Sep  8 05:51:36 nativespace-cdp sshd[3520689]: Connection closed by 159.100.136.21 port 48174 [preauth]
Sep  8 05:56:33 nativespace-cdp sshd[3521826]: Connection closed by 159.100.136.21 port 57106 [preauth]
Sep  8 06:01:33 nativespace-cdp sshd[3523022]: Connection closed by 159.100.136.21 port 38336 [preauth]
Sep  8 06:06:35 nativespace-cdp sshd[3524153]: Connection closed by 159.100.136.21 port 47862 [preauth]
Sep  8 06:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 06:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:34 nativespace-cdp sudo[3524752]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 06:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:34 nativespace-cdp sudo[3524756]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 06:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:35 nativespace-cdp sudo[3524761]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 06:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:35 nativespace-cdp sudo[3524767]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 06:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:38 nativespace-cdp sudo[3524773]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 06:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:38 nativespace-cdp sudo[3524788]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 06:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:38 nativespace-cdp sudo[3524793]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 06:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:38 nativespace-cdp sudo[3524798]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 06:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:38 nativespace-cdp sudo[3524805]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 06:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:38 nativespace-cdp sudo[3524810]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 06:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:38 nativespace-cdp sudo[3524816]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 06:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:54 nativespace-cdp sudo[3524871]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 06:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:54 nativespace-cdp sudo[3524878]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=wilsonsw user-2=musorguk user-3=megacards user-4=brmrjxl user-5=lakesan1 user-6=sarafoundation user-7=atestord user-8=strathar user-9=lbhyisi user-10=hhdugcor user-11=magichat user-12=martsblo user-13=ptkxhsbt user-14=dickemery123 user-15=ulsukarm user-16=foundation user-17=markward user-18=booff user-19=maflemin user-20=lbscrmod user-21=athenare user-22=connect9 user-23=vantagep user-24=still user-25=agproduc user-26=leereyn1 user-27=stephani user-28=jarvisin user-29=hodgesonweb user-30=theblack user-31=spectrum user-32=bedfords user-33=bemadonn user-34=belle user-35=ggaaorgu user-36=newstoda user-37=brighto1 user-38=nstriton user-39=battlere user-40=oneoarco user-41=firstre2 user-42=vivienn1 user-43=stuartge user-44=askhform user-45=innovat1 user-46=nativene user-47=alexadmin user-48=skyfirec
Sep  8 06:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=southlon user-53=highlegh user-54=firstred user-55=firstres user-56=jonhartl user-57=seftvta user-58=ultbcrra user-59=coursemc user-60=opaiscyx user-61=ianrayne user-62=accooper user-63=thqkgnbz user-64=connectedshoppin user-65=elecleis user-66=gilpin user-67=milloyco user-68=carsinyo user-69=fetch user-70=putterfi user-71=hubmaster user-72=isleofwi user-73=smrszyqg user-74=barbersh user-75=tigerlet user-76=hidden user-77=nomistakes user-78=fortunaz user-79=health2045 user-80=foods user-81=leftie user-82=putterfc user-83=nscdp user-84=ctedorgu user-85=philmcph user-86=firstre5 user-87=donnychicago user-88=steakbridieme user-89=lkpier user-90=hirefootballgame user-91=courseme user-92=eugincou user-93=ninejimm user-94=reliable user-95=cathski user-96=cambria1 user-97=pugwash user-98=howardon user-99=paulmca1 user-100=cwsocial user-101=zebrapho
Sep  8 06:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=bwppodcast user-103=steve user-104=asandcoc user-105=sibtoncc user-106=eatspam user-107=darkstar user-108=beauty user-109=dhyana user-110=burydropin user-111=fawcettd user-112=nsceres user-113=sosevalu user-114=crrtipdl user-115=bakery user-116=nove user-117=boldover user-118=kategilpin user-119=ladburyp user-120=stagingerris user-121=dancinggardener user-122=design user-123=what user-124=tstardom user-125=oubpgvbx user-126=nvihkvu user-127=cath user-128=sketchy user-129=havantho user-130=mcdermos user-131=chrisdal user-132=careers user-133=nbhavers user-134=david user-135=tomandle user-136=jennimil user-137=branko user-138=hodgsonmail user-139=outdoorc user-140=ranxterc user-141=romaldki user-142=attlebor user-143=lucy user-144=onlycont feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 06:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 06:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:55 nativespace-cdp sudo[3524885]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:55 nativespace-cdp sudo[3524892]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-e9UkseM46hhYjeUY.~
Sep  8 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:55 nativespace-cdp sudo[3524897]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-e9UkseM46hhYjeUY.~'
Sep  8 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:55 nativespace-cdp sudo[3524901]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-e9UkseM46hhYjeUY.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:56 nativespace-cdp sudo[3524907]: pam_unix(sudo:session): session closed for user root
Sep  8 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:09:56 nativespace-cdp sudo[3524912]: pam_unix(sudo:session): session closed for user root
Sep  8 06:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 06:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 06:10:05 nativespace-cdp sudo[3525061]: pam_unix(sudo:session): session closed for user root
Sep  8 06:11:33 nativespace-cdp sshd[3525390]: Connection closed by 159.100.136.21 port 56086 [preauth]
Sep  8 06:16:36 nativespace-cdp sshd[3526724]: Connection closed by 159.100.136.21 port 37940 [preauth]
Sep  8 06:21:33 nativespace-cdp sshd[3527700]: Connection closed by 159.100.136.21 port 47194 [preauth]
Sep  8 06:26:36 nativespace-cdp sshd[3528903]: Connection closed by 159.100.136.21 port 55774 [preauth]
Sep  8 06:31:33 nativespace-cdp sshd[3529903]: Connection closed by 159.100.136.21 port 36620 [preauth]
Sep  8 06:36:33 nativespace-cdp sshd[3530863]: Connection closed by 159.100.136.21 port 46114 [preauth]
Sep  8 06:41:34 nativespace-cdp sshd[3531911]: Connection closed by 159.100.136.21 port 54618 [preauth]
Sep  8 06:46:36 nativespace-cdp sshd[3533214]: Connection closed by 159.100.136.21 port 36132 [preauth]
Sep  8 06:51:33 nativespace-cdp sshd[3534202]: Connection closed by 159.100.136.21 port 44456 [preauth]
Sep  8 06:56:35 nativespace-cdp sshd[3535486]: Connection closed by 159.100.136.21 port 54208 [preauth]
Sep  8 07:01:33 nativespace-cdp sshd[3536539]: Connection closed by 159.100.136.21 port 34900 [preauth]
Sep  8 07:06:33 nativespace-cdp sshd[3537476]: Connection closed by 159.100.136.21 port 44804 [preauth]
Sep  8 07:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 07:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:33 nativespace-cdp sudo[3538108]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 07:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:34 nativespace-cdp sudo[3538112]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 07:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:34 nativespace-cdp sudo[3538117]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 07:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:34 nativespace-cdp sudo[3538123]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 07:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:36 nativespace-cdp sudo[3538129]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 07:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:36 nativespace-cdp sudo[3538138]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 07:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:36 nativespace-cdp sudo[3538142]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 07:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:36 nativespace-cdp sudo[3538147]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 07:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:36 nativespace-cdp sudo[3538152]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 07:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:36 nativespace-cdp sudo[3538157]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 07:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:36 nativespace-cdp sudo[3538164]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 07:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:43 nativespace-cdp sudo[3538195]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 07:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:43 nativespace-cdp sudo[3538201]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=connectedshoppin user-2=thqkgnbz user-3=accooper user-4=ianrayne user-5=hubmaster user-6=putterfi user-7=fetch user-8=carsinyo user-9=gilpin user-10=milloyco user-11=elecleis user-12=firstred user-13=highlegh user-14=southlon user-15=firstrel user-16=clarkass user-17=costestimatorco user-18=coursemc user-19=opaiscyx user-20=ultbcrra user-21=jonhartl user-22=seftvta user-23=firstres user-24=nativene user-25=innovat1 user-26=stuartge user-27=askhform user-28=skyfirec user-29=alexadmin user-30=newstoda user-31=ggaaorgu user-32=belle user-33=bemadonn user-34=bedfords user-35=vivienn1 user-36=firstre2 user-37=oneoarco user-38=battlere user-39=nstriton user-40=brighto1 user-41=stephani user-42=leereyn1 user-43=agproduc user-44=still user-45=spectrum user-46=hodgesonweb user-47=theblack
Sep  8 07:09:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=jarvisin user-49=ulsukarm user-50=vantagep user-51=athenare user-52=connect9 user-53=lbscrmod user-54=maflemin user-55=foundation user-56=markward user-57=booff user-58=magichat user-59=hhdugcor user-60=lbhyisi user-61=dickemery123 user-62=ptkxhsbt user-63=martsblo user-64=megacards user-65=musorguk user-66=wilsonsw user-67=strathar user-68=atestord user-69=sarafoundation user-70=brmrjxl user-71=lakesan1 user-72=romaldki user-73=hodgsonmail user-74=outdoorc user-75=ranxterc user-76=branko user-77=onlycont user-78=lucy user-79=attlebor user-80=david user-81=careers user-82=nbhavers user-83=chrisdal user-84=mcdermos user-85=jennimil user-86=tomandle user-87=design user-88=dancinggardener user-89=stagingerris user-90=ladburyp user-91=kategilpin user-92=havantho user-93=sketchy user-94=cath user-95=nvihkvu user-96=tstardom user-97=oubpgvbx user-98=what user-99=bakery user-100=crrtipdl user-101=sosevalu
Sep  8 07:09:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=boldover user-103=nove user-104=dhyana user-105=beauty user-106=darkstar user-107=eatspam user-108=nsceres user-109=fawcettd user-110=burydropin user-111=steve user-112=bwppodcast user-113=zebrapho user-114=sibtoncc user-115=asandcoc user-116=eugincou user-117=courseme user-118=hirefootballgame user-119=cwsocial user-120=howardon user-121=paulmca1 user-122=pugwash user-123=cambria1 user-124=cathski user-125=reliable user-126=ninejimm user-127=nomistakes user-128=hidden user-129=tigerlet user-130=barbersh user-131=isleofwi user-132=smrszyqg user-133=lkpier user-134=donnychicago user-135=steakbridieme user-136=firstre5 user-137=philmcph user-138=ctedorgu user-139=nscdp user-140=putterfc user-141=leftie user-142=foods user-143=health2045 user-144=fortunaz feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 07:09:44 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 07:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:44 nativespace-cdp sudo[3538210]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 07:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:44 nativespace-cdp sudo[3538219]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-QyVVcZUQJH2IVXYZ.~
Sep  8 07:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:44 nativespace-cdp sudo[3538224]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-QyVVcZUQJH2IVXYZ.~'
Sep  8 07:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:44 nativespace-cdp sudo[3538229]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-QyVVcZUQJH2IVXYZ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 07:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:44 nativespace-cdp sudo[3538235]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 07:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:44 nativespace-cdp sudo[3538240]: pam_unix(sudo:session): session closed for user root
Sep  8 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 07:09:51 nativespace-cdp sudo[3538282]: pam_unix(sudo:session): session closed for user root
Sep  8 07:11:35 nativespace-cdp sshd[3538826]: Connection closed by 159.100.136.21 port 54172 [preauth]
Sep  8 07:14:20 nativespace-cdp sshd[3539287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.169.133.70  user=root
Sep  8 07:14:20 nativespace-cdp sshd[3539287]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 07:14:21 nativespace-cdp sshd[3539287]: Failed password for root from 103.169.133.70 port 54674 ssh2
Sep  8 07:14:25 nativespace-cdp sshd[3539287]: Received disconnect from 103.169.133.70 port 54674:11: Bye Bye [preauth]
Sep  8 07:14:25 nativespace-cdp sshd[3539287]: Disconnected from 103.169.133.70 port 54674 [preauth]
Sep  8 07:16:18 nativespace-cdp sshd[3539904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.27.107  user=root
Sep  8 07:16:18 nativespace-cdp sshd[3539904]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 07:16:20 nativespace-cdp sshd[3539904]: Failed password for root from 51.79.27.107 port 54836 ssh2
Sep  8 07:16:22 nativespace-cdp sshd[3539904]: Received disconnect from 51.79.27.107 port 54836:11: Bye Bye [preauth]
Sep  8 07:16:22 nativespace-cdp sshd[3539904]: Disconnected from 51.79.27.107 port 54836 [preauth]
Sep  8 07:16:34 nativespace-cdp sshd[3539945]: Connection closed by 159.100.136.21 port 34498 [preauth]
Sep  8 07:18:51 nativespace-cdp sshd[3540309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.72.31.67  user=root
Sep  8 07:18:51 nativespace-cdp sshd[3540309]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 07:18:53 nativespace-cdp sshd[3540309]: Failed password for root from 27.72.31.67 port 55694 ssh2
Sep  8 07:18:54 nativespace-cdp sshd[3540309]: Received disconnect from 27.72.31.67 port 55694:11: Bye Bye [preauth]
Sep  8 07:18:54 nativespace-cdp sshd[3540309]: Disconnected from 27.72.31.67 port 55694 [preauth]
Sep  8 07:20:35 nativespace-cdp sshd[3540803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.177.222  user=root
Sep  8 07:20:35 nativespace-cdp sshd[3540803]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 07:20:37 nativespace-cdp sshd[3540803]: Failed password for root from 67.205.177.222 port 52104 ssh2
Sep  8 07:20:37 nativespace-cdp sshd[3540803]: Received disconnect from 67.205.177.222 port 52104:11: Bye Bye [preauth]
Sep  8 07:20:37 nativespace-cdp sshd[3540803]: Disconnected from 67.205.177.222 port 52104 [preauth]
Sep  8 07:21:35 nativespace-cdp sshd[3541011]: Connection closed by 159.100.136.21 port 42800 [preauth]
Sep  8 07:22:05 nativespace-cdp sshd[3541071]: Invalid user asdf from 51.79.27.107 port 54592
Sep  8 07:22:05 nativespace-cdp sshd[3541071]: input_userauth_request: invalid user asdf [preauth]
Sep  8 07:22:05 nativespace-cdp sshd[3541071]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 07:22:05 nativespace-cdp sshd[3541071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.27.107
Sep  8 07:22:06 nativespace-cdp sshd[3541071]: Failed password for invalid user asdf from 51.79.27.107 port 54592 ssh2
Sep  8 07:22:07 nativespace-cdp sshd[3541071]: Received disconnect from 51.79.27.107 port 54592:11: Bye Bye [preauth]
Sep  8 07:22:07 nativespace-cdp sshd[3541071]: Disconnected from 51.79.27.107 port 54592 [preauth]
Sep  8 07:22:27 nativespace-cdp sshd[3541135]: Invalid user upload from 189.127.173.52 port 59586
Sep  8 07:22:27 nativespace-cdp sshd[3541135]: input_userauth_request: invalid user upload [preauth]
Sep  8 07:22:27 nativespace-cdp sshd[3541135]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 07:22:27 nativespace-cdp sshd[3541135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.127.173.52
Sep  8 07:22:30 nativespace-cdp sshd[3541135]: Failed password for invalid user upload from 189.127.173.52 port 59586 ssh2
Sep  8 07:22:30 nativespace-cdp sshd[3541135]: Received disconnect from 189.127.173.52 port 59586:11: Bye Bye [preauth]
Sep  8 07:22:30 nativespace-cdp sshd[3541135]: Disconnected from 189.127.173.52 port 59586 [preauth]
Sep  8 07:22:30 nativespace-cdp sshd[3541149]: Invalid user eb from 67.205.177.222 port 42908
Sep  8 07:22:30 nativespace-cdp sshd[3541149]: input_userauth_request: invalid user eb [preauth]
Sep  8 07:22:30 nativespace-cdp sshd[3541149]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 07:22:30 nativespace-cdp sshd[3541149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.177.222
Sep  8 07:22:31 nativespace-cdp sshd[3541146]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.169.133.70  user=root
Sep  8 07:22:31 nativespace-cdp sshd[3541146]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 07:22:32 nativespace-cdp sshd[3541149]: Failed password for invalid user eb from 67.205.177.222 port 42908 ssh2
Sep  8 07:22:33 nativespace-cdp sshd[3541146]: Failed password for root from 103.169.133.70 port 55858 ssh2
Sep  8 07:22:34 nativespace-cdp sshd[3541146]: Received disconnect from 103.169.133.70 port 55858:11: Bye Bye [preauth]
Sep  8 07:22:34 nativespace-cdp sshd[3541146]: Disconnected from 103.169.133.70 port 55858 [preauth]
Sep  8 07:22:35 nativespace-cdp sshd[3541149]: Received disconnect from 67.205.177.222 port 42908:11: Bye Bye [preauth]
Sep  8 07:22:35 nativespace-cdp sshd[3541149]: Disconnected from 67.205.177.222 port 42908 [preauth]
Sep  8 07:22:41 nativespace-cdp sshd[3541188]: Invalid user ganesh from 51.79.27.107 port 56362
Sep  8 07:22:41 nativespace-cdp sshd[3541188]: input_userauth_request: invalid user ganesh [preauth]
Sep  8 07:22:41 nativespace-cdp sshd[3541188]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 07:22:41 nativespace-cdp sshd[3541188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.27.107
Sep  8 07:22:43 nativespace-cdp sshd[3541188]: Failed password for invalid user ganesh from 51.79.27.107 port 56362 ssh2
Sep  8 07:22:48 nativespace-cdp sshd[3541188]: Received disconnect from 51.79.27.107 port 56362:11: Bye Bye [preauth]
Sep  8 07:22:48 nativespace-cdp sshd[3541188]: Disconnected from 51.79.27.107 port 56362 [preauth]
Sep  8 07:23:07 nativespace-cdp sshd[3541277]: Invalid user insight from 67.205.177.222 port 48334
Sep  8 07:23:07 nativespace-cdp sshd[3541277]: input_userauth_request: invalid user insight [preauth]
Sep  8 07:23:07 nativespace-cdp sshd[3541277]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 07:23:07 nativespace-cdp sshd[3541277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.177.222
Sep  8 07:23:10 nativespace-cdp sshd[3541277]: Failed password for invalid user insight from 67.205.177.222 port 48334 ssh2
Sep  8 07:23:20 nativespace-cdp sshd[3541343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.169.133.70  user=ftp
Sep  8 07:23:20 nativespace-cdp sshd[3541343]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "ftp"
Sep  8 07:23:22 nativespace-cdp sshd[3541343]: Failed password for ftp from 103.169.133.70 port 35326 ssh2
Sep  8 07:23:22 nativespace-cdp sshd[3541343]: Received disconnect from 103.169.133.70 port 35326:11: Bye Bye [preauth]
Sep  8 07:23:22 nativespace-cdp sshd[3541343]: Disconnected from 103.169.133.70 port 35326 [preauth]
Sep  8 07:26:35 nativespace-cdp sshd[3542140]: Connection closed by 159.100.136.21 port 51938 [preauth]
Sep  8 07:28:12 nativespace-cdp sshd[3542438]: Invalid user speed from 189.127.173.52 port 46824
Sep  8 07:28:12 nativespace-cdp sshd[3542438]: input_userauth_request: invalid user speed [preauth]
Sep  8 07:28:12 nativespace-cdp sshd[3542438]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 07:28:12 nativespace-cdp sshd[3542438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.127.173.52
Sep  8 07:28:14 nativespace-cdp sshd[3542438]: Failed password for invalid user speed from 189.127.173.52 port 46824 ssh2
Sep  8 07:28:14 nativespace-cdp sshd[3542438]: Received disconnect from 189.127.173.52 port 46824:11: Bye Bye [preauth]
Sep  8 07:28:14 nativespace-cdp sshd[3542438]: Disconnected from 189.127.173.52 port 46824 [preauth]
Sep  8 07:29:05 nativespace-cdp sshd[3542861]: Invalid user ligang from 189.127.173.52 port 42696
Sep  8 07:29:05 nativespace-cdp sshd[3542861]: input_userauth_request: invalid user ligang [preauth]
Sep  8 07:29:05 nativespace-cdp sshd[3542861]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 07:29:05 nativespace-cdp sshd[3542861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.127.173.52
Sep  8 07:29:07 nativespace-cdp sshd[3542861]: Failed password for invalid user ligang from 189.127.173.52 port 42696 ssh2
Sep  8 07:29:07 nativespace-cdp sshd[3542861]: Received disconnect from 189.127.173.52 port 42696:11: Bye Bye [preauth]
Sep  8 07:29:07 nativespace-cdp sshd[3542861]: Disconnected from 189.127.173.52 port 42696 [preauth]
Sep  8 07:29:56 nativespace-cdp sshd[3543576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.72.31.67  user=root
Sep  8 07:29:56 nativespace-cdp sshd[3543576]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 07:29:58 nativespace-cdp sshd[3543576]: Failed password for root from 27.72.31.67 port 53892 ssh2
Sep  8 07:30:02 nativespace-cdp sshd[3543576]: Received disconnect from 27.72.31.67 port 53892:11: Bye Bye [preauth]
Sep  8 07:30:03 nativespace-cdp sshd[3543576]: Disconnected from 27.72.31.67 port 53892 [preauth]
Sep  8 07:30:27 nativespace-cdp sshd[3544153]: Invalid user speed from 27.72.31.67 port 60268
Sep  8 07:30:27 nativespace-cdp sshd[3544153]: input_userauth_request: invalid user speed [preauth]
Sep  8 07:30:27 nativespace-cdp sshd[3544153]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 07:30:27 nativespace-cdp sshd[3544153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.72.31.67
Sep  8 07:30:29 nativespace-cdp sshd[3544153]: Failed password for invalid user speed from 27.72.31.67 port 60268 ssh2
Sep  8 07:31:33 nativespace-cdp sshd[3545370]: Connection closed by 159.100.136.21 port 33188 [preauth]
Sep  8 07:36:33 nativespace-cdp sshd[3546732]: Connection closed by 159.100.136.21 port 42940 [preauth]
Sep  8 07:41:35 nativespace-cdp sshd[3547860]: Connection closed by 159.100.136.21 port 52508 [preauth]
Sep  8 07:46:33 nativespace-cdp sshd[3549000]: Connection closed by 159.100.136.21 port 33524 [preauth]
Sep  8 07:51:35 nativespace-cdp sshd[3549895]: Connection closed by 159.100.136.21 port 41242 [preauth]
Sep  8 07:56:34 nativespace-cdp sshd[3551043]: Connection closed by 159.100.136.21 port 50508 [preauth]
Sep  8 08:01:33 nativespace-cdp sshd[3552241]: Connection closed by 159.100.136.21 port 59570 [preauth]
Sep  8 08:06:35 nativespace-cdp sshd[3553404]: Connection closed by 159.100.136.21 port 41162 [preauth]
Sep  8 08:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 08:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:34 nativespace-cdp sudo[3553891]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 08:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:34 nativespace-cdp sudo[3553896]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 08:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:34 nativespace-cdp sudo[3553901]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 08:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:35 nativespace-cdp sudo[3553907]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 08:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:36 nativespace-cdp sudo[3553914]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 08:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:36 nativespace-cdp sudo[3553925]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 08:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:36 nativespace-cdp sudo[3553930]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 08:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:36 nativespace-cdp sudo[3553934]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 08:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:36 nativespace-cdp sudo[3553939]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 08:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:36 nativespace-cdp sudo[3553944]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 08:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:36 nativespace-cdp sudo[3553951]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 08:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:41 nativespace-cdp sudo[3553973]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 08:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:41 nativespace-cdp sudo[3553982]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=leereyn1 user-2=stephani user-3=agproduc user-4=still user-5=hodgesonweb user-6=theblack user-7=spectrum user-8=jarvisin user-9=ulsukarm user-10=lbscrmod user-11=maflemin user-12=vantagep user-13=connect9 user-14=athenare user-15=booff user-16=markward user-17=foundation user-18=magichat user-19=hhdugcor user-20=lbhyisi user-21=ptkxhsbt user-22=dickemery123 user-23=martsblo user-24=megacards user-25=musorguk user-26=wilsonsw user-27=atestord user-28=sarafoundation user-29=strathar user-30=brmrjxl user-31=lakesan1 user-32=thqkgnbz user-33=connectedshoppin user-34=ianrayne user-35=accooper user-36=fetch user-37=carsinyo user-38=hubmaster user-39=putterfi user-40=elecleis user-41=gilpin user-42=milloyco user-43=highlegh user-44=southlon user-45=firstred user-46=costestimatorco user-47=firstrel
Sep  8 08:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=clarkass user-49=opaiscyx user-50=coursemc user-51=firstres user-52=ultbcrra user-53=seftvta user-54=jonhartl user-55=nativene user-56=askhform user-57=stuartge user-58=innovat1 user-59=alexadmin user-60=skyfirec user-61=bemadonn user-62=newstoda user-63=ggaaorgu user-64=belle user-65=bedfords user-66=oneoarco user-67=battlere user-68=vivienn1 user-69=firstre2 user-70=nstriton user-71=brighto1 user-72=dhyana user-73=darkstar user-74=eatspam user-75=beauty user-76=nsceres user-77=fawcettd user-78=burydropin user-79=steve user-80=zebrapho user-81=bwppodcast user-82=sibtoncc user-83=asandcoc user-84=courseme user-85=eugincou user-86=hirefootballgame user-87=cwsocial user-88=pugwash user-89=howardon user-90=paulmca1 user-91=reliable user-92=ninejimm user-93=cathski user-94=cambria1 user-95=tigerlet user-96=barbersh user-97=nomistakes user-98=hidden user-99=isleofwi user-100=smrszyqg user-101=donnychicago
Sep  8 08:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=firstre5 user-103=steakbridieme user-104=philmcph user-105=ctedorgu user-106=lkpier user-107=foods user-108=leftie user-109=health2045 user-110=fortunaz user-111=nscdp user-112=putterfc user-113=romaldki user-114=branko user-115=hodgsonmail user-116=outdoorc user-117=ranxterc user-118=onlycont user-119=lucy user-120=attlebor user-121=david user-122=careers user-123=nbhavers user-124=mcdermos user-125=chrisdal user-126=jennimil user-127=tomandle user-128=design user-129=kategilpin user-130=stagingerris user-131=dancinggardener user-132=ladburyp user-133=nvihkvu user-134=havantho user-135=cath user-136=sketchy user-137=what user-138=tstardom user-139=oubpgvbx user-140=crrtipdl user-141=sosevalu user-142=bakery user-143=boldover user-144=nove feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 08:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 08:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:42 nativespace-cdp sudo[3553989]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 08:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:42 nativespace-cdp sudo[3553996]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NcFntpAmc48qU2wH.~
Sep  8 08:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:42 nativespace-cdp sudo[3554003]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NcFntpAmc48qU2wH.~'
Sep  8 08:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:42 nativespace-cdp sudo[3554007]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NcFntpAmc48qU2wH.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 08:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:42 nativespace-cdp sudo[3554013]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 08:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:42 nativespace-cdp sudo[3554018]: pam_unix(sudo:session): session closed for user root
Sep  8 08:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 08:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 08:09:43 nativespace-cdp sudo[3554039]: pam_unix(sudo:session): session closed for user root
Sep  8 08:11:33 nativespace-cdp sshd[3554721]: Connection closed by 159.100.136.21 port 50270 [preauth]
Sep  8 08:16:33 nativespace-cdp sshd[3555937]: Connection closed by 159.100.136.21 port 59984 [preauth]
Sep  8 08:21:35 nativespace-cdp sshd[3556959]: Connection closed by 159.100.136.21 port 40540 [preauth]
Sep  8 08:26:34 nativespace-cdp sshd[3558165]: Connection closed by 159.100.136.21 port 50000 [preauth]
Sep  8 08:31:36 nativespace-cdp sshd[3559417]: Connection closed by 159.100.136.21 port 59634 [preauth]
Sep  8 08:36:33 nativespace-cdp sshd[3560459]: Connection closed by 159.100.136.21 port 41202 [preauth]
Sep  8 08:41:35 nativespace-cdp sshd[3561529]: Connection closed by 159.100.136.21 port 50762 [preauth]
Sep  8 08:46:35 nativespace-cdp sshd[3562873]: Connection closed by 159.100.136.21 port 60410 [preauth]
Sep  8 08:51:34 nativespace-cdp sshd[3564070]: Connection closed by 159.100.136.21 port 40192 [preauth]
Sep  8 08:56:33 nativespace-cdp sshd[3565305]: Connection closed by 159.100.136.21 port 49606 [preauth]
Sep  8 09:01:33 nativespace-cdp sshd[3566670]: Connection closed by 159.100.136.21 port 58984 [preauth]
Sep  8 09:06:33 nativespace-cdp sshd[3567671]: Connection closed by 159.100.136.21 port 38464 [preauth]
Sep  8 09:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 09:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:45 nativespace-cdp sudo[3568204]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 09:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:45 nativespace-cdp sudo[3568209]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 09:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:47 nativespace-cdp sudo[3568215]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 09:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:47 nativespace-cdp sudo[3568222]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 09:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:52 nativespace-cdp sudo[3568228]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 09:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:52 nativespace-cdp sudo[3568252]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 09:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:53 nativespace-cdp sudo[3568257]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 09:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:53 nativespace-cdp sudo[3568261]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 09:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:53 nativespace-cdp sudo[3568266]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 09:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:53 nativespace-cdp sudo[3568271]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 09:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:53 nativespace-cdp sudo[3568277]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 09:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:58 nativespace-cdp sudo[3568292]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 09:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:09:59 nativespace-cdp sudo[3568301]: pam_unix(sudo:session): session closed for user root
Sep  8 09:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bakery user-2=sosevalu user-3=crrtipdl user-4=boldover user-5=nove user-6=design user-7=ladburyp user-8=stagingerris user-9=dancinggardener user-10=kategilpin user-11=cath user-12=sketchy user-13=havantho user-14=nvihkvu user-15=oubpgvbx user-16=tstardom user-17=what user-18=nbhavers user-19=careers user-20=david user-21=chrisdal user-22=mcdermos user-23=jennimil user-24=tomandle user-25=romaldki user-26=ranxterc user-27=hodgsonmail user-28=outdoorc user-29=branko user-30=onlycont user-31=attlebor user-32=lucy user-33=hidden user-34=nomistakes user-35=tigerlet user-36=barbersh user-37=isleofwi user-38=smrszyqg user-39=lkpier user-40=philmcph user-41=ctedorgu user-42=steakbridieme user-43=firstre5 user-44=donnychicago user-45=putterfc user-46=nscdp user-47=fortunaz user-48=health2045
Sep  8 09:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=foods user-50=leftie user-51=eugincou user-52=courseme user-53=hirefootballgame user-54=howardon user-55=pugwash user-56=paulmca1 user-57=cwsocial user-58=cambria1 user-59=cathski user-60=ninejimm user-61=reliable user-62=steve user-63=bwppodcast user-64=zebrapho user-65=asandcoc user-66=sibtoncc user-67=dhyana user-68=beauty user-69=eatspam user-70=darkstar user-71=nsceres user-72=burydropin user-73=fawcettd user-74=ggaaorgu user-75=belle user-76=newstoda user-77=bemadonn user-78=bedfords user-79=firstre2 user-80=vivienn1 user-81=battlere user-82=oneoarco user-83=brighto1 user-84=nstriton user-85=nativene user-86=innovat1 user-87=askhform user-88=stuartge user-89=alexadmin user-90=skyfirec user-91=firstred user-92=southlon user-93=highlegh user-94=clarkass user-95=firstrel user-96=costestimatorco user-97=opaiscyx user-98=coursemc user-99=jonhartl user-100=seftvta user-101=ultbcrra user-102=firstres
Sep  8 09:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=connectedshoppin user-104=thqkgnbz user-105=accooper user-106=ianrayne user-107=putterfi user-108=hubmaster user-109=carsinyo user-110=fetch user-111=gilpin user-112=milloyco user-113=elecleis user-114=musorguk user-115=megacards user-116=wilsonsw user-117=strathar user-118=sarafoundation user-119=atestord user-120=brmrjxl user-121=lakesan1 user-122=magichat user-123=lbhyisi user-124=hhdugcor user-125=dickemery123 user-126=ptkxhsbt user-127=martsblo user-128=ulsukarm user-129=athenare user-130=connect9 user-131=vantagep user-132=maflemin user-133=lbscrmod user-134=foundation user-135=markward user-136=booff user-137=stephani user-138=leereyn1 user-139=still user-140=agproduc user-141=spectrum user-142=theblack user-143=hodgesonweb user-144=jarvisin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 09:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 09:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:10:00 nativespace-cdp sudo[3568310]: pam_unix(sudo:session): session closed for user root
Sep  8 09:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 09:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:10:00 nativespace-cdp sudo[3568320]: pam_unix(sudo:session): session closed for user root
Sep  8 09:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kZz9VzTEofaHAeRH.~
Sep  8 09:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:10:01 nativespace-cdp sudo[3568326]: pam_unix(sudo:session): session closed for user root
Sep  8 09:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kZz9VzTEofaHAeRH.~'
Sep  8 09:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:10:01 nativespace-cdp sudo[3568330]: pam_unix(sudo:session): session closed for user root
Sep  8 09:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kZz9VzTEofaHAeRH.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 09:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:10:01 nativespace-cdp sudo[3568336]: pam_unix(sudo:session): session closed for user root
Sep  8 09:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 09:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:10:01 nativespace-cdp sudo[3568341]: pam_unix(sudo:session): session closed for user root
Sep  8 09:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 09:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 09:10:03 nativespace-cdp sudo[3568454]: pam_unix(sudo:session): session closed for user root
Sep  8 09:11:34 nativespace-cdp sshd[3569113]: Connection closed by 159.100.136.21 port 47582 [preauth]
Sep  8 09:16:33 nativespace-cdp sshd[3570094]: Connection closed by 159.100.136.21 port 57114 [preauth]
Sep  8 09:21:36 nativespace-cdp sshd[3571178]: Connection closed by 159.100.136.21 port 37972 [preauth]
Sep  8 09:26:34 nativespace-cdp sshd[3572275]: Connection closed by 159.100.136.21 port 46284 [preauth]
Sep  8 09:31:33 nativespace-cdp sshd[3573577]: Connection closed by 159.100.136.21 port 55858 [preauth]
Sep  8 09:36:33 nativespace-cdp sshd[3574729]: Connection closed by 159.100.136.21 port 37224 [preauth]
Sep  8 09:41:33 nativespace-cdp sshd[3576002]: Connection closed by 159.100.136.21 port 46312 [preauth]
Sep  8 09:43:58 nativespace-cdp sshd[3576458]: Did not receive identification string from 199.45.154.114 port 44926
Sep  8 09:44:20 nativespace-cdp sshd[3576494]: Connection closed by 199.45.154.114 port 57930 [preauth]
Sep  8 09:46:34 nativespace-cdp sshd[3577084]: Connection closed by 159.100.136.21 port 55684 [preauth]
Sep  8 09:50:27 nativespace-cdp sshd[3577808]: Invalid user admin from 181.55.188.218 port 37694
Sep  8 09:50:27 nativespace-cdp sshd[3577808]: input_userauth_request: invalid user admin [preauth]
Sep  8 09:50:27 nativespace-cdp sshd[3577808]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 09:50:27 nativespace-cdp sshd[3577808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.55.188.218
Sep  8 09:50:29 nativespace-cdp sshd[3577808]: Failed password for invalid user admin from 181.55.188.218 port 37694 ssh2
Sep  8 09:50:33 nativespace-cdp sshd[3577808]: Received disconnect from 181.55.188.218 port 37694:11: Bye Bye [preauth]
Sep  8 09:50:33 nativespace-cdp sshd[3577808]: Disconnected from 181.55.188.218 port 37694 [preauth]
Sep  8 09:51:33 nativespace-cdp sshd[3578129]: Connection closed by 159.100.136.21 port 37000 [preauth]
Sep  8 09:51:43 nativespace-cdp sshd[3578203]: Invalid user devadmin from 103.163.119.151 port 43222
Sep  8 09:51:43 nativespace-cdp sshd[3578203]: input_userauth_request: invalid user devadmin [preauth]
Sep  8 09:51:43 nativespace-cdp sshd[3578203]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 09:51:43 nativespace-cdp sshd[3578203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.163.119.151
Sep  8 09:51:44 nativespace-cdp sshd[3578203]: Failed password for invalid user devadmin from 103.163.119.151 port 43222 ssh2
Sep  8 09:51:45 nativespace-cdp sshd[3578203]: Received disconnect from 103.163.119.151 port 43222:11: Bye Bye [preauth]
Sep  8 09:51:45 nativespace-cdp sshd[3578203]: Disconnected from 103.163.119.151 port 43222 [preauth]
Sep  8 09:51:57 nativespace-cdp sshd[3578247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.8.46.60  user=root
Sep  8 09:51:57 nativespace-cdp sshd[3578247]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 09:51:59 nativespace-cdp sshd[3578247]: Failed password for root from 45.8.46.60 port 54382 ssh2
Sep  8 09:52:02 nativespace-cdp sshd[3578247]: Received disconnect from 45.8.46.60 port 54382:11: Bye Bye [preauth]
Sep  8 09:52:02 nativespace-cdp sshd[3578247]: Disconnected from 45.8.46.60 port 54382 [preauth]
Sep  8 09:52:40 nativespace-cdp sshd[3578356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.253.238.218  user=root
Sep  8 09:52:40 nativespace-cdp sshd[3578356]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 09:52:42 nativespace-cdp sshd[3578356]: Failed password for root from 182.253.238.218 port 56768 ssh2
Sep  8 09:52:42 nativespace-cdp sshd[3578356]: Received disconnect from 182.253.238.218 port 56768:11: Bye Bye [preauth]
Sep  8 09:52:42 nativespace-cdp sshd[3578356]: Disconnected from 182.253.238.218 port 56768 [preauth]
Sep  8 09:56:33 nativespace-cdp sshd[3579245]: Connection closed by 159.100.136.21 port 46724 [preauth]
Sep  8 09:56:56 nativespace-cdp sshd[3579301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.55.188.218  user=root
Sep  8 09:56:56 nativespace-cdp sshd[3579301]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 09:56:58 nativespace-cdp sshd[3579301]: Failed password for root from 181.55.188.218 port 57306 ssh2
Sep  8 09:56:58 nativespace-cdp sshd[3579301]: Received disconnect from 181.55.188.218 port 57306:11: Bye Bye [preauth]
Sep  8 09:56:58 nativespace-cdp sshd[3579301]: Disconnected from 181.55.188.218 port 57306 [preauth]
Sep  8 09:57:16 nativespace-cdp sshd[3579353]: Invalid user sonar from 182.253.238.218 port 47598
Sep  8 09:57:16 nativespace-cdp sshd[3579353]: input_userauth_request: invalid user sonar [preauth]
Sep  8 09:57:16 nativespace-cdp sshd[3579353]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 09:57:16 nativespace-cdp sshd[3579353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.253.238.218
Sep  8 09:57:18 nativespace-cdp sshd[3579353]: Failed password for invalid user sonar from 182.253.238.218 port 47598 ssh2
Sep  8 09:57:19 nativespace-cdp sshd[3579353]: Received disconnect from 182.253.238.218 port 47598:11: Bye Bye [preauth]
Sep  8 09:57:19 nativespace-cdp sshd[3579353]: Disconnected from 182.253.238.218 port 47598 [preauth]
Sep  8 09:57:29 nativespace-cdp sshd[3579381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.163.119.151  user=root
Sep  8 09:57:29 nativespace-cdp sshd[3579381]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 09:57:32 nativespace-cdp sshd[3579381]: Failed password for root from 103.163.119.151 port 60034 ssh2
Sep  8 09:57:34 nativespace-cdp sshd[3579381]: Received disconnect from 103.163.119.151 port 60034:11: Bye Bye [preauth]
Sep  8 09:57:34 nativespace-cdp sshd[3579381]: Disconnected from 103.163.119.151 port 60034 [preauth]
Sep  8 09:57:39 nativespace-cdp sshd[3579411]: Invalid user paul from 45.8.46.60 port 41360
Sep  8 09:57:39 nativespace-cdp sshd[3579411]: input_userauth_request: invalid user paul [preauth]
Sep  8 09:57:39 nativespace-cdp sshd[3579411]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 09:57:39 nativespace-cdp sshd[3579411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.8.46.60
Sep  8 09:57:40 nativespace-cdp sshd[3579411]: Failed password for invalid user paul from 45.8.46.60 port 41360 ssh2
Sep  8 09:57:40 nativespace-cdp sshd[3579411]: Received disconnect from 45.8.46.60 port 41360:11: Bye Bye [preauth]
Sep  8 09:57:40 nativespace-cdp sshd[3579411]: Disconnected from 45.8.46.60 port 41360 [preauth]
Sep  8 09:57:49 nativespace-cdp sshd[3579427]: Invalid user rocky from 181.55.188.218 port 41976
Sep  8 09:57:49 nativespace-cdp sshd[3579427]: input_userauth_request: invalid user rocky [preauth]
Sep  8 09:57:49 nativespace-cdp sshd[3579427]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 09:57:49 nativespace-cdp sshd[3579427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.55.188.218
Sep  8 09:57:50 nativespace-cdp sshd[3579427]: Failed password for invalid user rocky from 181.55.188.218 port 41976 ssh2
Sep  8 09:57:53 nativespace-cdp sshd[3579427]: Received disconnect from 181.55.188.218 port 41976:11: Bye Bye [preauth]
Sep  8 09:57:53 nativespace-cdp sshd[3579427]: Disconnected from 181.55.188.218 port 41976 [preauth]
Sep  8 09:58:03 nativespace-cdp sshd[3579495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.253.238.218  user=root
Sep  8 09:58:03 nativespace-cdp sshd[3579495]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 09:58:05 nativespace-cdp sshd[3579495]: Failed password for root from 182.253.238.218 port 55324 ssh2
Sep  8 09:58:05 nativespace-cdp sshd[3579495]: Received disconnect from 182.253.238.218 port 55324:11: Bye Bye [preauth]
Sep  8 09:58:05 nativespace-cdp sshd[3579495]: Disconnected from 182.253.238.218 port 55324 [preauth]
Sep  8 09:58:21 nativespace-cdp sshd[3579597]: Invalid user vagrant from 45.8.46.60 port 54698
Sep  8 09:58:21 nativespace-cdp sshd[3579597]: input_userauth_request: invalid user vagrant [preauth]
Sep  8 09:58:21 nativespace-cdp sshd[3579597]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 09:58:21 nativespace-cdp sshd[3579597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.8.46.60
Sep  8 09:58:23 nativespace-cdp sshd[3579597]: Failed password for invalid user vagrant from 45.8.46.60 port 54698 ssh2
Sep  8 09:58:35 nativespace-cdp sshd[3579739]: Connection closed by 103.163.119.151 port 47660 [preauth]
Sep  8 09:59:24 nativespace-cdp sshd[3579903]: Invalid user plexuser from 103.163.119.151 port 54056
Sep  8 09:59:24 nativespace-cdp sshd[3579903]: input_userauth_request: invalid user plexuser [preauth]
Sep  8 09:59:24 nativespace-cdp sshd[3579903]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 09:59:24 nativespace-cdp sshd[3579903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.163.119.151
Sep  8 09:59:26 nativespace-cdp sshd[3579903]: Failed password for invalid user plexuser from 103.163.119.151 port 54056 ssh2
Sep  8 09:59:26 nativespace-cdp sshd[3579903]: Received disconnect from 103.163.119.151 port 54056:11: Bye Bye [preauth]
Sep  8 09:59:26 nativespace-cdp sshd[3579903]: Disconnected from 103.163.119.151 port 54056 [preauth]
Sep  8 10:01:33 nativespace-cdp sshd[3580559]: Connection closed by 159.100.136.21 port 55010 [preauth]
Sep  8 10:06:33 nativespace-cdp sshd[3581875]: Connection closed by 159.100.136.21 port 36362 [preauth]
Sep  8 10:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 10:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:41 nativespace-cdp sudo[3582382]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 10:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:41 nativespace-cdp sudo[3582387]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 10:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:42 nativespace-cdp sudo[3582392]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 10:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:42 nativespace-cdp sudo[3582404]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 10:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:46 nativespace-cdp sudo[3582410]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 10:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:46 nativespace-cdp sudo[3582427]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 10:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:46 nativespace-cdp sudo[3582432]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 10:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:46 nativespace-cdp sudo[3582436]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 10:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:46 nativespace-cdp sudo[3582441]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 10:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:46 nativespace-cdp sudo[3582447]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 10:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:46 nativespace-cdp sudo[3582452]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:59 nativespace-cdp sudo[3582501]: pam_unix(sudo:session): session closed for user root
Sep  8 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:09:59 nativespace-cdp sudo[3582508]: pam_unix(sudo:session): session closed for user root
Sep  8 10:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=brighto1 user-2=nstriton user-3=battlere user-4=oneoarco user-5=firstre2 user-6=vivienn1 user-7=bedfords user-8=bemadonn user-9=belle user-10=ggaaorgu user-11=newstoda user-12=alexadmin user-13=skyfirec user-14=askhform user-15=stuartge user-16=innovat1 user-17=nativene user-18=firstres user-19=seftvta user-20=jonhartl user-21=ultbcrra user-22=coursemc user-23=opaiscyx user-24=costestimatorco user-25=firstrel user-26=clarkass user-27=southlon user-28=highlegh user-29=firstred user-30=elecleis user-31=milloyco user-32=gilpin user-33=carsinyo user-34=fetch user-35=hubmaster user-36=putterfi user-37=ianrayne user-38=accooper user-39=thqkgnbz user-40=connectedshoppin user-41=lakesan1 user-42=brmrjxl user-43=sarafoundation user-44=atestord user-45=strathar user-46=wilsonsw user-47=musorguk
Sep  8 10:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=martsblo user-50=ptkxhsbt user-51=dickemery123 user-52=lbhyisi user-53=hhdugcor user-54=magichat user-55=foundation user-56=markward user-57=booff user-58=maflemin user-59=lbscrmod user-60=athenare user-61=connect9 user-62=vantagep user-63=ulsukarm user-64=jarvisin user-65=theblack user-66=hodgesonweb user-67=spectrum user-68=still user-69=agproduc user-70=leereyn1 user-71=stephani user-72=nove user-73=boldover user-74=sosevalu user-75=crrtipdl user-76=bakery user-77=what user-78=oubpgvbx user-79=tstardom user-80=nvihkvu user-81=sketchy user-82=cath user-83=havantho user-84=kategilpin user-85=ladburyp user-86=dancinggardener user-87=stagingerris user-88=design user-89=tomandle user-90=jennimil user-91=mcdermos user-92=chrisdal user-93=nbhavers user-94=careers user-95=david user-96=attlebor user-97=lucy user-98=onlycont user-99=branko user-100=hodgsonmail user-101=ranxterc
Sep  8 10:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=outdoorc user-103=romaldki user-104=fortunaz user-105=health2045 user-106=leftie user-107=foods user-108=putterfc user-109=nscdp user-110=philmcph user-111=ctedorgu user-112=firstre5 user-113=steakbridieme user-114=donnychicago user-115=lkpier user-116=isleofwi user-117=smrszyqg user-118=barbersh user-119=tigerlet user-120=hidden user-121=nomistakes user-122=ninejimm user-123=reliable user-124=cathski user-125=cambria1 user-126=pugwash user-127=howardon user-128=paulmca1 user-129=cwsocial user-130=hirefootballgame user-131=courseme user-132=eugincou user-133=asandcoc user-134=sibtoncc user-135=zebrapho user-136=bwppodcast user-137=steve user-138=burydropin user-139=fawcettd user-140=nsceres user-141=eatspam user-142=darkstar user-143=beauty user-144=dhyana feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  8 10:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 10:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:10:01 nativespace-cdp sudo[3582518]: pam_unix(sudo:session): session closed for user root
Sep  8 10:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 10:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:10:02 nativespace-cdp sudo[3582635]: pam_unix(sudo:session): session closed for user root
Sep  8 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DMMwaLzk0WLC8WBn.~
Sep  8 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:10:03 nativespace-cdp sudo[3582639]: pam_unix(sudo:session): session closed for user root
Sep  8 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DMMwaLzk0WLC8WBn.~'
Sep  8 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:10:03 nativespace-cdp sudo[3582642]: pam_unix(sudo:session): session closed for user root
Sep  8 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DMMwaLzk0WLC8WBn.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:10:03 nativespace-cdp sudo[3582647]: pam_unix(sudo:session): session closed for user root
Sep  8 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:10:03 nativespace-cdp sudo[3582650]: pam_unix(sudo:session): session closed for user root
Sep  8 10:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 10:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 10:10:10 nativespace-cdp sudo[3582688]: pam_unix(sudo:session): session closed for user root
Sep  8 10:11:34 nativespace-cdp sshd[3583304]: Connection closed by 159.100.136.21 port 45402 [preauth]
Sep  8 10:16:33 nativespace-cdp sshd[3584323]: Connection closed by 159.100.136.21 port 54556 [preauth]
Sep  8 10:21:33 nativespace-cdp sshd[3585407]: Connection closed by 159.100.136.21 port 35412 [preauth]
Sep  8 10:26:36 nativespace-cdp sshd[3586396]: Connection closed by 159.100.136.21 port 44970 [preauth]
Sep  8 10:31:36 nativespace-cdp sshd[3587897]: Connection closed by 159.100.136.21 port 53952 [preauth]
Sep  8 10:36:34 nativespace-cdp sshd[3588885]: Connection closed by 159.100.136.21 port 35588 [preauth]
Sep  8 10:41:33 nativespace-cdp sshd[3590151]: Connection closed by 159.100.136.21 port 45000 [preauth]
Sep  8 10:46:33 nativespace-cdp sshd[3591271]: Connection closed by 159.100.136.21 port 54130 [preauth]
Sep  8 10:51:33 nativespace-cdp sshd[3592453]: Connection closed by 159.100.136.21 port 35138 [preauth]
Sep  8 10:56:34 nativespace-cdp sshd[3593797]: Connection closed by 159.100.136.21 port 44602 [preauth]
Sep  8 11:01:34 nativespace-cdp sshd[3595017]: Connection closed by 159.100.136.21 port 54138 [preauth]
Sep  8 11:06:34 nativespace-cdp sshd[3596246]: Connection closed by 159.100.136.21 port 35738 [preauth]
Sep  8 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:34 nativespace-cdp sudo[3596875]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:35 nativespace-cdp sudo[3596879]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:35 nativespace-cdp sudo[3596884]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:35 nativespace-cdp sudo[3596890]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:37 nativespace-cdp sudo[3596896]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:38 nativespace-cdp sudo[3596912]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:38 nativespace-cdp sudo[3596917]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:38 nativespace-cdp sudo[3596921]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:38 nativespace-cdp sudo[3596926]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:38 nativespace-cdp sudo[3596932]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:38 nativespace-cdp sudo[3596937]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 11:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:40 nativespace-cdp sudo[3596959]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 11:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:40 nativespace-cdp sudo[3596966]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=steve user-2=zebrapho user-3=bwppodcast user-4=asandcoc user-5=sibtoncc user-6=dhyana user-7=eatspam user-8=darkstar user-9=beauty user-10=nsceres user-11=burydropin user-12=fawcettd user-13=tigerlet user-14=barbersh user-15=hidden user-16=nomistakes user-17=isleofwi user-18=smrszyqg user-19=philmcph user-20=ctedorgu user-21=firstre5 user-22=donnychicago user-23=steakbridieme user-24=lkpier user-25=fortunaz user-26=health2045 user-27=leftie user-28=foods user-29=putterfc user-30=nscdp user-31=courseme user-32=eugincou user-33=hirefootballgame user-34=howardon user-35=pugwash user-36=paulmca1 user-37=cwsocial user-38=ninejimm user-39=reliable user-40=cathski user-41=cambria1 user-42=nbhavers user-43=careers user-44=david user-45=mcdermos user-46=chrisdal user-47=jennimil user-48=tomandle
Sep  8 11:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=branko user-51=ranxterc user-52=hodgsonmail user-53=outdoorc user-54=onlycont user-55=attlebor user-56=lucy user-57=sosevalu user-58=crrtipdl user-59=bakery user-60=boldover user-61=nove user-62=design user-63=kategilpin user-64=ladburyp user-65=stagingerris user-66=dancinggardener user-67=nvihkvu user-68=cath user-69=sketchy user-70=havantho user-71=what user-72=oubpgvbx user-73=tstardom user-74=ulsukarm user-75=maflemin user-76=lbscrmod user-77=connect9 user-78=athenare user-79=vantagep user-80=markward user-81=foundation user-82=booff user-83=leereyn1 user-84=stephani user-85=still user-86=agproduc user-87=theblack user-88=hodgesonweb user-89=spectrum user-90=jarvisin user-91=musorguk user-92=megacards user-93=wilsonsw user-94=sarafoundation user-95=atestord user-96=strathar user-97=lakesan1 user-98=brmrjxl user-99=magichat user-100=lbhyisi user-101=hhdugcor user-102=ptkxhsbt
Sep  8 11:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=dickemery123 user-104=martsblo user-105=southlon user-106=highlegh user-107=firstred user-108=costestimatorco user-109=clarkass user-110=firstrel user-111=coursemc user-112=opaiscyx user-113=firstres user-114=jonhartl user-115=seftvta user-116=ultbcrra user-117=thqkgnbz user-118=connectedshoppin user-119=ianrayne user-120=accooper user-121=carsinyo user-122=fetch user-123=putterfi user-124=hubmaster user-125=elecleis user-126=gilpin user-127=milloyco user-128=bemadonn user-129=ggaaorgu user-130=belle user-131=newstoda user-132=bedfords user-133=battlere user-134=oneoarco user-135=firstre2 user-136=vivienn1 user-137=brighto1 user-138=nstriton user-139=nativene user-140=askhform user-141=stuartge user-142=innovat1 user-143=alexadmin user-144=skyfirec feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 11:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 11:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:41 nativespace-cdp sudo[3596972]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  8 11:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:42 nativespace-cdp sudo[3596990]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep  8 11:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  8 11:09:42 nativespace-cdp sudo[3596996]: pam_unix(sudo:session): session closed for user onlycont
Sep  8 11:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  8 11:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:43 nativespace-cdp sudo[3597010]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  8 11:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 11:09:43 nativespace-cdp sudo[3597016]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 11:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  8 11:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:45 nativespace-cdp sudo[3597037]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep  8 11:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  8 11:09:45 nativespace-cdp sudo[3597041]: pam_unix(sudo:session): session closed for user lkpier
Sep  8 11:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  8 11:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:46 nativespace-cdp sudo[3597055]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep  8 11:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  8 11:09:46 nativespace-cdp sudo[3597059]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  8 11:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  8 11:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  8 11:09:46 nativespace-cdp sudo[3597072]: pam_unix(sudo:session): session closed for user oneoarco
Sep  8 11:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  8 11:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:47 nativespace-cdp sudo[3597087]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep  8 11:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  8 11:09:47 nativespace-cdp sudo[3597092]: pam_unix(sudo:session): session closed for user fortunaz
Sep  8 11:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep  8 11:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:47 nativespace-cdp sudo[3597104]: pam_unix(sudo:session): session closed for user root
Sep  8 11:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 11:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:09:47 nativespace-cdp sudo[3597108]: pam_unix(sudo:session): session closed for user root
Sep  8 11:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep  8 11:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:10:05 nativespace-cdp sudo[3598168]: pam_unix(sudo:session): session closed for user root
Sep  8 11:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep  8 11:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:10:05 nativespace-cdp sudo[3598173]: pam_unix(sudo:session): session closed for user root
Sep  8 11:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 11:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:10:11 nativespace-cdp sudo[3598190]: pam_unix(sudo:session): session closed for user root
Sep  8 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yR99X53QAmcQaQHu.~
Sep  8 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:10:12 nativespace-cdp sudo[3598193]: pam_unix(sudo:session): session closed for user root
Sep  8 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yR99X53QAmcQaQHu.~'
Sep  8 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:10:12 nativespace-cdp sudo[3598196]: pam_unix(sudo:session): session closed for user root
Sep  8 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yR99X53QAmcQaQHu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:10:12 nativespace-cdp sudo[3598200]: pam_unix(sudo:session): session closed for user root
Sep  8 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:10:12 nativespace-cdp sudo[3598204]: pam_unix(sudo:session): session closed for user root
Sep  8 11:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 11:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 11:10:13 nativespace-cdp sudo[3598218]: pam_unix(sudo:session): session closed for user root
Sep  8 11:11:36 nativespace-cdp sshd[3598854]: Connection closed by 159.100.136.21 port 45200 [preauth]
Sep  8 11:16:36 nativespace-cdp sshd[3599996]: Connection closed by 159.100.136.21 port 54564 [preauth]
Sep  8 11:21:36 nativespace-cdp sshd[3601104]: Connection closed by 159.100.136.21 port 34598 [preauth]
Sep  8 11:26:33 nativespace-cdp sshd[3602359]: Connection closed by 159.100.136.21 port 44116 [preauth]
Sep  8 11:31:35 nativespace-cdp sshd[3603535]: Connection closed by 159.100.136.21 port 53724 [preauth]
Sep  8 11:36:33 nativespace-cdp sshd[3604633]: Connection closed by 159.100.136.21 port 35390 [preauth]
Sep  8 11:41:33 nativespace-cdp sshd[3606128]: Connection closed by 159.100.136.21 port 44586 [preauth]
Sep  8 11:46:35 nativespace-cdp sshd[3607246]: Connection closed by 159.100.136.21 port 53972 [preauth]
Sep  8 11:51:33 nativespace-cdp sshd[3608321]: Connection closed by 159.100.136.21 port 34222 [preauth]
Sep  8 11:56:35 nativespace-cdp sshd[3609521]: Connection closed by 159.100.136.21 port 43380 [preauth]
Sep  8 12:01:33 nativespace-cdp sshd[3610618]: Connection closed by 159.100.136.21 port 52448 [preauth]
Sep  8 12:06:33 nativespace-cdp sshd[3611790]: Connection closed by 159.100.136.21 port 33586 [preauth]
Sep  8 12:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 12:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:35 nativespace-cdp sudo[3612335]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 12:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:35 nativespace-cdp sudo[3612339]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 12:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:35 nativespace-cdp sudo[3612344]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 12:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:35 nativespace-cdp sudo[3612353]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 12:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:38 nativespace-cdp sudo[3612359]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:38 nativespace-cdp sudo[3612372]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:38 nativespace-cdp sudo[3612377]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:38 nativespace-cdp sudo[3612381]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:38 nativespace-cdp sudo[3612386]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:38 nativespace-cdp sudo[3612392]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 12:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:38 nativespace-cdp sudo[3612398]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 12:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:43 nativespace-cdp sudo[3612419]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 12:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:43 nativespace-cdp sudo[3612425]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=isleofwi user-2=smrszyqg user-3=barbersh user-4=tigerlet user-5=nomistakes user-6=hidden user-7=foods user-8=leftie user-9=health2045 user-10=fortunaz user-11=nscdp user-12=putterfc user-13=donnychicago user-14=steakbridieme user-15=firstre5 user-16=ctedorgu user-17=philmcph user-18=lkpier user-19=hirefootballgame user-20=courseme user-21=eugincou user-22=ninejimm user-23=reliable user-24=cathski user-25=cambria1 user-26=cwsocial user-27=howardon user-28=pugwash user-29=paulmca1 user-30=zebrapho user-31=bwppodcast user-32=steve user-33=sibtoncc user-34=asandcoc user-35=darkstar user-36=eatspam user-37=beauty user-38=dhyana user-39=fawcettd user-40=burydropin user-41=nsceres user-42=crrtipdl user-43=sosevalu user-44=bakery user-45=nove user-46=boldover user-47=kategilpin user-48=stagingerris
Sep  8 12:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=dancinggardener user-50=ladburyp user-51=design user-52=what user-53=oubpgvbx user-54=tstardom user-55=nvihkvu user-56=havantho user-57=cath user-58=sketchy user-59=mcdermos user-60=chrisdal user-61=david user-62=careers user-63=nbhavers user-64=tomandle user-65=jennimil user-66=branko user-67=hodgsonmail user-68=outdoorc user-69=ranxterc user-70=romaldki user-71=lucy user-72=attlebor user-73=onlycont user-74=wilsonsw user-75=megacards user-76=musorguk user-77=brmrjxl user-78=lakesan1 user-79=atestord user-80=sarafoundation user-81=strathar user-82=hhdugcor user-83=lbhyisi user-84=magichat user-85=martsblo user-86=ptkxhsbt user-87=dickemery123 user-88=ulsukarm user-89=foundation user-90=booff user-91=markward user-92=lbscrmod user-93=maflemin user-94=vantagep user-95=connect9 user-96=athenare user-97=agproduc user-98=still user-99=leereyn1 user-100=stephani user-101=jarvisin user-102=theblack
Sep  8 12:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=hodgesonweb user-104=spectrum user-105=bedfords user-106=bemadonn user-107=newstoda user-108=ggaaorgu user-109=belle user-110=nstriton user-111=brighto1 user-112=oneoarco user-113=battlere user-114=vivienn1 user-115=firstre2 user-116=stuartge user-117=askhform user-118=innovat1 user-119=nativene user-120=skyfirec user-121=alexadmin user-122=costestimatorco user-123=clarkass user-124=firstrel user-125=highlegh user-126=southlon user-127=firstred user-128=firstres user-129=ultbcrra user-130=jonhartl user-131=seftvta user-132=coursemc user-133=opaiscyx user-134=ianrayne user-135=accooper user-136=thqkgnbz user-137=connectedshoppin user-138=elecleis user-139=gilpin user-140=milloyco user-141=fetch user-142=carsinyo user-143=hubmaster user-144=putterfi feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 12:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 12:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:44 nativespace-cdp sudo[3612431]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:44 nativespace-cdp sudo[3612438]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-bKWMJMYe48UzWXHI.~
Sep  8 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:44 nativespace-cdp sudo[3612443]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-bKWMJMYe48UzWXHI.~'
Sep  8 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:44 nativespace-cdp sudo[3612447]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-bKWMJMYe48UzWXHI.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:44 nativespace-cdp sudo[3612453]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:44 nativespace-cdp sudo[3612458]: pam_unix(sudo:session): session closed for user root
Sep  8 12:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 12:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 12:09:54 nativespace-cdp sudo[3612495]: pam_unix(sudo:session): session closed for user root
Sep  8 12:11:33 nativespace-cdp sshd[3612974]: Connection closed by 159.100.136.21 port 42904 [preauth]
Sep  8 12:16:33 nativespace-cdp sshd[3614211]: Connection closed by 159.100.136.21 port 52358 [preauth]
Sep  8 12:21:33 nativespace-cdp sshd[3615230]: Connection closed by 159.100.136.21 port 33054 [preauth]
Sep  8 12:26:35 nativespace-cdp sshd[3616246]: Connection closed by 159.100.136.21 port 42920 [preauth]
Sep  8 12:31:33 nativespace-cdp sshd[3617782]: Connection closed by 159.100.136.21 port 52480 [preauth]
Sep  8 12:36:33 nativespace-cdp sshd[3618963]: Connection closed by 159.100.136.21 port 33958 [preauth]
Sep  8 12:41:33 nativespace-cdp sshd[3620135]: Connection closed by 159.100.136.21 port 43186 [preauth]
Sep  8 12:46:33 nativespace-cdp sshd[3621372]: Connection closed by 159.100.136.21 port 52082 [preauth]
Sep  8 12:51:35 nativespace-cdp sshd[3622359]: Connection closed by 159.100.136.21 port 33004 [preauth]
Sep  8 12:56:33 nativespace-cdp sshd[3623333]: Connection closed by 159.100.136.21 port 42106 [preauth]
Sep  8 13:01:33 nativespace-cdp sshd[3624780]: Connection closed by 159.100.136.21 port 51060 [preauth]
Sep  8 13:06:38 nativespace-cdp sshd[3625988]: Connection closed by 159.100.136.21 port 59422 [preauth]
Sep  8 13:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 13:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:42 nativespace-cdp sudo[3628154]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 13:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:42 nativespace-cdp sudo[3628159]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 13:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:44 nativespace-cdp sudo[3628164]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 13:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:44 nativespace-cdp sudo[3628185]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 13:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:48 nativespace-cdp sudo[3628191]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 13:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:48 nativespace-cdp sudo[3628228]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 13:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:48 nativespace-cdp sudo[3628233]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 13:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:48 nativespace-cdp sudo[3628238]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 13:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:48 nativespace-cdp sudo[3628243]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 13:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:48 nativespace-cdp sudo[3628249]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 13:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:48 nativespace-cdp sudo[3628256]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 13:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:56 nativespace-cdp sudo[3628279]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 13:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:57 nativespace-cdp sudo[3628285]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=attlebor user-2=lucy user-3=onlycont user-4=hodgsonmail user-5=ranxterc user-6=outdoorc user-7=branko user-8=romaldki user-9=tomandle user-10=jennimil user-11=chrisdal user-12=mcdermos user-13=careers user-14=nbhavers user-15=david user-16=tstardom user-17=oubpgvbx user-18=what user-19=cath user-20=sketchy user-21=havantho user-22=nvihkvu user-23=ladburyp user-24=stagingerris user-25=dancinggardener user-26=kategilpin user-27=design user-28=nove user-29=boldover user-30=bakery user-31=sosevalu user-32=crrtipdl user-33=burydropin user-34=fawcettd user-35=nsceres user-36=beauty user-37=eatspam user-38=darkstar user-39=dhyana user-40=asandcoc user-41=sibtoncc user-42=bwppodcast user-43=zebrapho user-44=steve user-45=cathski user-46=cambria1 user-47=reliable user-48=ninejimm user-49=howardon
Sep  8 13:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=paulmca1 user-51=pugwash user-52=cwsocial user-53=hirefootballgame user-54=eugincou user-55=courseme user-56=putterfc user-57=nscdp user-58=health2045 user-59=fortunaz user-60=leftie user-61=foods user-62=lkpier user-63=philmcph user-64=ctedorgu user-65=steakbridieme user-66=firstre5 user-67=donnychicago user-68=isleofwi user-69=smrszyqg user-70=hidden user-71=nomistakes user-72=barbersh user-73=tigerlet user-74=milloyco user-75=gilpin user-76=elecleis user-77=putterfi user-78=hubmaster user-79=carsinyo user-80=fetch user-81=accooper user-82=ianrayne user-83=connectedshoppin user-84=thqkgnbz user-85=jonhartl user-86=seftvta user-87=ultbcrra user-88=firstres user-89=opaiscyx user-90=coursemc user-91=firstrel user-92=clarkass user-93=costestimatorco user-94=firstred user-95=southlon user-96=highlegh user-97=alexadmin user-98=skyfirec user-99=innovat1 user-100=stuartge user-101=askhform user-102=nativene
Sep  8 13:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=brighto1 user-104=nstriton user-105=firstre2 user-106=vivienn1 user-107=battlere user-108=oneoarco user-109=bedfords user-110=ggaaorgu user-111=belle user-112=newstoda user-113=bemadonn user-114=jarvisin user-115=spectrum user-116=hodgesonweb user-117=theblack user-118=still user-119=agproduc user-120=stephani user-121=leereyn1 user-122=markward user-123=foundation user-124=booff user-125=athenare user-126=connect9 user-127=vantagep user-128=maflemin user-129=lbscrmod user-130=ulsukarm user-131=martsblo user-132=dickemery123 user-133=ptkxhsbt user-134=lbhyisi user-135=hhdugcor user-136=magichat user-137=lakesan1 user-138=brmrjxl user-139=strathar user-140=sarafoundation user-141=atestord user-142=wilsonsw user-143=musorguk user-144=megacards feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 13:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 13:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:59 nativespace-cdp sudo[3628294]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 13:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:59 nativespace-cdp sudo[3628304]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dh5n01X7pWxYRIT4.~
Sep  8 13:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:59 nativespace-cdp sudo[3628309]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dh5n01X7pWxYRIT4.~'
Sep  8 13:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:59 nativespace-cdp sudo[3628313]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dh5n01X7pWxYRIT4.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 13:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:59 nativespace-cdp sudo[3628319]: pam_unix(sudo:session): session closed for user root
Sep  8 13:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 13:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:09:59 nativespace-cdp sudo[3628324]: pam_unix(sudo:session): session closed for user root
Sep  8 13:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 13:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 13:10:17 nativespace-cdp sudo[3628556]: pam_unix(sudo:session): session closed for user root
Sep  8 13:11:33 nativespace-cdp sshd[3629162]: Connection closed by 159.100.136.21 port 40060 [preauth]
Sep  8 13:16:10 nativespace-cdp sshd[3631114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.225.126.147  user=root
Sep  8 13:16:10 nativespace-cdp sshd[3631114]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:16:12 nativespace-cdp sshd[3631114]: Failed password for root from 20.225.126.147 port 52488 ssh2
Sep  8 13:16:12 nativespace-cdp sshd[3631114]: Received disconnect from 20.225.126.147 port 52488:11: Bye Bye [preauth]
Sep  8 13:16:12 nativespace-cdp sshd[3631114]: Disconnected from 20.225.126.147 port 52488 [preauth]
Sep  8 13:16:33 nativespace-cdp sshd[3631316]: Connection closed by 159.100.136.21 port 48968 [preauth]
Sep  8 13:18:18 nativespace-cdp sshd[3632157]: Invalid user dee from 163.172.154.32 port 57252
Sep  8 13:18:18 nativespace-cdp sshd[3632157]: input_userauth_request: invalid user dee [preauth]
Sep  8 13:18:18 nativespace-cdp sshd[3632157]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:18:18 nativespace-cdp sshd[3632157]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.172.154.32
Sep  8 13:18:20 nativespace-cdp sshd[3632181]: Invalid user ftpuser1 from 192.241.171.230 port 58000
Sep  8 13:18:20 nativespace-cdp sshd[3632181]: input_userauth_request: invalid user ftpuser1 [preauth]
Sep  8 13:18:20 nativespace-cdp sshd[3632181]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:18:20 nativespace-cdp sshd[3632181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.171.230
Sep  8 13:18:20 nativespace-cdp sshd[3632157]: Failed password for invalid user dee from 163.172.154.32 port 57252 ssh2
Sep  8 13:18:20 nativespace-cdp sshd[3632157]: Received disconnect from 163.172.154.32 port 57252:11: Bye Bye [preauth]
Sep  8 13:18:20 nativespace-cdp sshd[3632157]: Disconnected from 163.172.154.32 port 57252 [preauth]
Sep  8 13:18:22 nativespace-cdp sshd[3632181]: Failed password for invalid user ftpuser1 from 192.241.171.230 port 58000 ssh2
Sep  8 13:18:22 nativespace-cdp sshd[3632181]: Received disconnect from 192.241.171.230 port 58000:11: Bye Bye [preauth]
Sep  8 13:18:22 nativespace-cdp sshd[3632181]: Disconnected from 192.241.171.230 port 58000 [preauth]
Sep  8 13:19:43 nativespace-cdp sshd[3632759]: Invalid user jiaxuan from 202.168.72.118 port 56728
Sep  8 13:19:43 nativespace-cdp sshd[3632759]: input_userauth_request: invalid user jiaxuan [preauth]
Sep  8 13:19:43 nativespace-cdp sshd[3632759]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:19:43 nativespace-cdp sshd[3632759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.168.72.118
Sep  8 13:19:45 nativespace-cdp sshd[3632759]: Failed password for invalid user jiaxuan from 202.168.72.118 port 56728 ssh2
Sep  8 13:19:45 nativespace-cdp sshd[3632759]: Received disconnect from 202.168.72.118 port 56728:11: Bye Bye [preauth]
Sep  8 13:19:45 nativespace-cdp sshd[3632759]: Disconnected from 202.168.72.118 port 56728 [preauth]
Sep  8 13:20:02 nativespace-cdp sshd[3632970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.225.126.147  user=root
Sep  8 13:20:02 nativespace-cdp sshd[3632970]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:20:04 nativespace-cdp sshd[3632970]: Failed password for root from 20.225.126.147 port 41994 ssh2
Sep  8 13:20:04 nativespace-cdp sshd[3632970]: Received disconnect from 20.225.126.147 port 41994:11: Bye Bye [preauth]
Sep  8 13:20:04 nativespace-cdp sshd[3632970]: Disconnected from 20.225.126.147 port 41994 [preauth]
Sep  8 13:20:05 nativespace-cdp sshd[3632998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.171.230  user=root
Sep  8 13:20:05 nativespace-cdp sshd[3632998]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:20:06 nativespace-cdp sshd[3632998]: Failed password for root from 192.241.171.230 port 49196 ssh2
Sep  8 13:20:07 nativespace-cdp sshd[3632998]: Received disconnect from 192.241.171.230 port 49196:11: Bye Bye [preauth]
Sep  8 13:20:07 nativespace-cdp sshd[3632998]: Disconnected from 192.241.171.230 port 49196 [preauth]
Sep  8 13:20:44 nativespace-cdp sshd[3633287]: Invalid user unison from 192.241.171.230 port 33760
Sep  8 13:20:44 nativespace-cdp sshd[3633287]: input_userauth_request: invalid user unison [preauth]
Sep  8 13:20:44 nativespace-cdp sshd[3633287]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:20:44 nativespace-cdp sshd[3633287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.171.230
Sep  8 13:20:45 nativespace-cdp sshd[3633287]: Failed password for invalid user unison from 192.241.171.230 port 33760 ssh2
Sep  8 13:20:46 nativespace-cdp sshd[3633287]: Received disconnect from 192.241.171.230 port 33760:11: Bye Bye [preauth]
Sep  8 13:20:46 nativespace-cdp sshd[3633287]: Disconnected from 192.241.171.230 port 33760 [preauth]
Sep  8 13:20:49 nativespace-cdp sshd[3633306]: Invalid user sample from 20.225.126.147 port 52114
Sep  8 13:20:49 nativespace-cdp sshd[3633306]: input_userauth_request: invalid user sample [preauth]
Sep  8 13:20:49 nativespace-cdp sshd[3633306]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:20:49 nativespace-cdp sshd[3633306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.225.126.147
Sep  8 13:20:51 nativespace-cdp sshd[3633306]: Failed password for invalid user sample from 20.225.126.147 port 52114 ssh2
Sep  8 13:21:01 nativespace-cdp sshd[3633468]: Invalid user unison from 202.168.72.118 port 43980
Sep  8 13:21:01 nativespace-cdp sshd[3633468]: input_userauth_request: invalid user unison [preauth]
Sep  8 13:21:01 nativespace-cdp sshd[3633468]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:21:01 nativespace-cdp sshd[3633468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.168.72.118
Sep  8 13:21:03 nativespace-cdp sshd[3633468]: Failed password for invalid user unison from 202.168.72.118 port 43980 ssh2
Sep  8 13:21:05 nativespace-cdp sshd[3633468]: Received disconnect from 202.168.72.118 port 43980:11: Bye Bye [preauth]
Sep  8 13:21:05 nativespace-cdp sshd[3633468]: Disconnected from 202.168.72.118 port 43980 [preauth]
Sep  8 13:21:10 nativespace-cdp sshd[3633547]: Invalid user user from 163.172.154.32 port 51060
Sep  8 13:21:10 nativespace-cdp sshd[3633547]: input_userauth_request: invalid user user [preauth]
Sep  8 13:21:10 nativespace-cdp sshd[3633547]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:21:10 nativespace-cdp sshd[3633547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.172.154.32
Sep  8 13:21:12 nativespace-cdp sshd[3633547]: Failed password for invalid user user from 163.172.154.32 port 51060 ssh2
Sep  8 13:21:16 nativespace-cdp sshd[3633547]: Received disconnect from 163.172.154.32 port 51060:11: Bye Bye [preauth]
Sep  8 13:21:16 nativespace-cdp sshd[3633547]: Disconnected from 163.172.154.32 port 51060 [preauth]
Sep  8 13:21:33 nativespace-cdp sshd[3633687]: Connection closed by 159.100.136.21 port 57626 [preauth]
Sep  8 13:21:42 nativespace-cdp sshd[3633712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.172.154.32  user=root
Sep  8 13:21:42 nativespace-cdp sshd[3633712]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:21:45 nativespace-cdp sshd[3633712]: Failed password for root from 163.172.154.32 port 47868 ssh2
Sep  8 13:21:48 nativespace-cdp sshd[3633712]: Received disconnect from 163.172.154.32 port 47868:11: Bye Bye [preauth]
Sep  8 13:21:48 nativespace-cdp sshd[3633712]: Disconnected from 163.172.154.32 port 47868 [preauth]
Sep  8 13:21:50 nativespace-cdp sshd[3633744]: Invalid user qbtuser from 202.168.72.118 port 45686
Sep  8 13:21:50 nativespace-cdp sshd[3633744]: input_userauth_request: invalid user qbtuser [preauth]
Sep  8 13:21:50 nativespace-cdp sshd[3633744]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:21:50 nativespace-cdp sshd[3633744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.168.72.118
Sep  8 13:21:52 nativespace-cdp sshd[3633744]: Failed password for invalid user qbtuser from 202.168.72.118 port 45686 ssh2
Sep  8 13:21:52 nativespace-cdp sshd[3633744]: Received disconnect from 202.168.72.118 port 45686:11: Bye Bye [preauth]
Sep  8 13:21:52 nativespace-cdp sshd[3633744]: Disconnected from 202.168.72.118 port 45686 [preauth]
Sep  8 13:26:33 nativespace-cdp sshd[3636334]: Connection closed by 159.100.136.21 port 38954 [preauth]
Sep  8 13:29:39 nativespace-cdp sshd[3637861]: Invalid user xieyuan from 91.103.252.1 port 37642
Sep  8 13:29:39 nativespace-cdp sshd[3637861]: input_userauth_request: invalid user xieyuan [preauth]
Sep  8 13:29:39 nativespace-cdp sshd[3637861]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:29:39 nativespace-cdp sshd[3637861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.103.252.1
Sep  8 13:29:41 nativespace-cdp sshd[3637861]: Failed password for invalid user xieyuan from 91.103.252.1 port 37642 ssh2
Sep  8 13:29:41 nativespace-cdp sshd[3637861]: Received disconnect from 91.103.252.1 port 37642:11: Bye Bye [preauth]
Sep  8 13:29:41 nativespace-cdp sshd[3637861]: Disconnected from 91.103.252.1 port 37642 [preauth]
Sep  8 13:30:21 nativespace-cdp sshd[3638357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.120.188.20  user=root
Sep  8 13:30:21 nativespace-cdp sshd[3638357]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:30:22 nativespace-cdp sshd[3638357]: Failed password for root from 181.120.188.20 port 40249 ssh2
Sep  8 13:30:26 nativespace-cdp sshd[3638357]: Received disconnect from 181.120.188.20 port 40249:11: Bye Bye [preauth]
Sep  8 13:30:26 nativespace-cdp sshd[3638357]: Disconnected from 181.120.188.20 port 40249 [preauth]
Sep  8 13:31:33 nativespace-cdp sshd[3638927]: Connection closed by 159.100.136.21 port 47754 [preauth]
Sep  8 13:32:47 nativespace-cdp sshd[3639694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.207.94.128  user=root
Sep  8 13:32:47 nativespace-cdp sshd[3639694]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:32:49 nativespace-cdp sshd[3639694]: Failed password for root from 67.207.94.128 port 52996 ssh2
Sep  8 13:32:49 nativespace-cdp sshd[3639694]: Received disconnect from 67.207.94.128 port 52996:11: Bye Bye [preauth]
Sep  8 13:32:49 nativespace-cdp sshd[3639694]: Disconnected from 67.207.94.128 port 52996 [preauth]
Sep  8 13:33:20 nativespace-cdp sshd[3640081]: Invalid user admin from 159.89.173.71 port 42024
Sep  8 13:33:20 nativespace-cdp sshd[3640081]: input_userauth_request: invalid user admin [preauth]
Sep  8 13:33:20 nativespace-cdp sshd[3640081]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:33:20 nativespace-cdp sshd[3640081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.173.71
Sep  8 13:33:21 nativespace-cdp sshd[3640081]: Failed password for invalid user admin from 159.89.173.71 port 42024 ssh2
Sep  8 13:33:42 nativespace-cdp sshd[3640127]: Invalid user dang from 47.76.83.235 port 54086
Sep  8 13:33:42 nativespace-cdp sshd[3640127]: input_userauth_request: invalid user dang [preauth]
Sep  8 13:33:42 nativespace-cdp sshd[3640127]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:33:42 nativespace-cdp sshd[3640127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.76.83.235
Sep  8 13:33:44 nativespace-cdp sshd[3640127]: Failed password for invalid user dang from 47.76.83.235 port 54086 ssh2
Sep  8 13:33:46 nativespace-cdp sshd[3640081]: Received disconnect from 159.89.173.71 port 42024:11: Bye Bye [preauth]
Sep  8 13:33:46 nativespace-cdp sshd[3640081]: Disconnected from 159.89.173.71 port 42024 [preauth]
Sep  8 13:33:47 nativespace-cdp sshd[3640127]: Received disconnect from 47.76.83.235 port 54086:11: Bye Bye [preauth]
Sep  8 13:33:47 nativespace-cdp sshd[3640127]: Disconnected from 47.76.83.235 port 54086 [preauth]
Sep  8 13:34:57 nativespace-cdp sshd[3640307]: Invalid user developer from 20.40.73.192 port 60964
Sep  8 13:34:57 nativespace-cdp sshd[3640307]: input_userauth_request: invalid user developer [preauth]
Sep  8 13:34:57 nativespace-cdp sshd[3640307]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:34:57 nativespace-cdp sshd[3640307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.40.73.192
Sep  8 13:34:59 nativespace-cdp sshd[3640307]: Failed password for invalid user developer from 20.40.73.192 port 60964 ssh2
Sep  8 13:35:00 nativespace-cdp sshd[3640307]: Received disconnect from 20.40.73.192 port 60964:11: Bye Bye [preauth]
Sep  8 13:35:00 nativespace-cdp sshd[3640307]: Disconnected from 20.40.73.192 port 60964 [preauth]
Sep  8 13:35:07 nativespace-cdp sshd[3640444]: Invalid user ftpuser from 47.236.229.92 port 38488
Sep  8 13:35:07 nativespace-cdp sshd[3640444]: input_userauth_request: invalid user ftpuser [preauth]
Sep  8 13:35:07 nativespace-cdp sshd[3640444]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:35:07 nativespace-cdp sshd[3640444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.229.92
Sep  8 13:35:09 nativespace-cdp sshd[3640444]: Failed password for invalid user ftpuser from 47.236.229.92 port 38488 ssh2
Sep  8 13:35:12 nativespace-cdp sshd[3640444]: Received disconnect from 47.236.229.92 port 38488:11: Bye Bye [preauth]
Sep  8 13:35:12 nativespace-cdp sshd[3640444]: Disconnected from 47.236.229.92 port 38488 [preauth]
Sep  8 13:36:23 nativespace-cdp sshd[3640782]: Invalid user solo from 47.76.83.235 port 58612
Sep  8 13:36:23 nativespace-cdp sshd[3640782]: input_userauth_request: invalid user solo [preauth]
Sep  8 13:36:23 nativespace-cdp sshd[3640782]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:36:23 nativespace-cdp sshd[3640782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.76.83.235
Sep  8 13:36:25 nativespace-cdp sshd[3640782]: Failed password for invalid user solo from 47.76.83.235 port 58612 ssh2
Sep  8 13:36:26 nativespace-cdp sshd[3640782]: Received disconnect from 47.76.83.235 port 58612:11: Bye Bye [preauth]
Sep  8 13:36:26 nativespace-cdp sshd[3640782]: Disconnected from 47.76.83.235 port 58612 [preauth]
Sep  8 13:36:33 nativespace-cdp sshd[3640808]: Connection closed by 159.100.136.21 port 56858 [preauth]
Sep  8 13:36:40 nativespace-cdp sshd[3640831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.103.252.1  user=root
Sep  8 13:36:40 nativespace-cdp sshd[3640831]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:36:42 nativespace-cdp sshd[3640831]: Failed password for root from 91.103.252.1 port 49200 ssh2
Sep  8 13:36:43 nativespace-cdp sshd[3640831]: Received disconnect from 91.103.252.1 port 49200:11: Bye Bye [preauth]
Sep  8 13:36:43 nativespace-cdp sshd[3640831]: Disconnected from 91.103.252.1 port 49200 [preauth]
Sep  8 13:36:45 nativespace-cdp sshd[3640848]: Invalid user test from 47.76.83.235 port 41420
Sep  8 13:36:45 nativespace-cdp sshd[3640848]: input_userauth_request: invalid user test [preauth]
Sep  8 13:36:45 nativespace-cdp sshd[3640848]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:36:45 nativespace-cdp sshd[3640848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.76.83.235
Sep  8 13:36:46 nativespace-cdp sshd[3640851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.214.174  user=root
Sep  8 13:36:46 nativespace-cdp sshd[3640851]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:36:47 nativespace-cdp sshd[3640848]: Failed password for invalid user test from 47.76.83.235 port 41420 ssh2
Sep  8 13:36:48 nativespace-cdp sshd[3640851]: Failed password for root from 103.130.214.174 port 53608 ssh2
Sep  8 13:36:52 nativespace-cdp sshd[3640851]: Received disconnect from 103.130.214.174 port 53608:11: Bye Bye [preauth]
Sep  8 13:36:52 nativespace-cdp sshd[3640851]: Disconnected from 103.130.214.174 port 53608 [preauth]
Sep  8 13:36:55 nativespace-cdp sshd[3640900]: Did not receive identification string from 47.236.229.92 port 54670
Sep  8 13:36:57 nativespace-cdp sshd[3640905]: Invalid user wangrong from 67.207.94.128 port 58498
Sep  8 13:36:57 nativespace-cdp sshd[3640905]: input_userauth_request: invalid user wangrong [preauth]
Sep  8 13:36:57 nativespace-cdp sshd[3640905]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:36:57 nativespace-cdp sshd[3640905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.207.94.128
Sep  8 13:36:59 nativespace-cdp sshd[3640905]: Failed password for invalid user wangrong from 67.207.94.128 port 58498 ssh2
Sep  8 13:36:59 nativespace-cdp sshd[3640905]: Received disconnect from 67.207.94.128 port 58498:11: Bye Bye [preauth]
Sep  8 13:36:59 nativespace-cdp sshd[3640905]: Disconnected from 67.207.94.128 port 58498 [preauth]
Sep  8 13:37:19 nativespace-cdp sshd[3640977]: Invalid user hector from 47.236.229.92 port 34346
Sep  8 13:37:19 nativespace-cdp sshd[3640977]: input_userauth_request: invalid user hector [preauth]
Sep  8 13:37:19 nativespace-cdp sshd[3640977]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:37:19 nativespace-cdp sshd[3640977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.229.92
Sep  8 13:37:21 nativespace-cdp sshd[3640977]: Failed password for invalid user hector from 47.236.229.92 port 34346 ssh2
Sep  8 13:37:23 nativespace-cdp sshd[3640977]: Received disconnect from 47.236.229.92 port 34346:11: Bye Bye [preauth]
Sep  8 13:37:23 nativespace-cdp sshd[3640977]: Disconnected from 47.236.229.92 port 34346 [preauth]
Sep  8 13:37:35 nativespace-cdp sshd[3641063]: Invalid user james from 159.89.173.71 port 47198
Sep  8 13:37:35 nativespace-cdp sshd[3641063]: input_userauth_request: invalid user james [preauth]
Sep  8 13:37:35 nativespace-cdp sshd[3641063]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:37:35 nativespace-cdp sshd[3641063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.173.71
Sep  8 13:37:37 nativespace-cdp sshd[3641063]: Failed password for invalid user james from 159.89.173.71 port 47198 ssh2
Sep  8 13:37:37 nativespace-cdp sshd[3641063]: Received disconnect from 159.89.173.71 port 47198:11: Bye Bye [preauth]
Sep  8 13:37:37 nativespace-cdp sshd[3641063]: Disconnected from 159.89.173.71 port 47198 [preauth]
Sep  8 13:37:39 nativespace-cdp sshd[3641076]: Invalid user adonis from 67.207.94.128 port 43074
Sep  8 13:37:39 nativespace-cdp sshd[3641076]: input_userauth_request: invalid user adonis [preauth]
Sep  8 13:37:39 nativespace-cdp sshd[3641076]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:37:39 nativespace-cdp sshd[3641076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.207.94.128
Sep  8 13:37:40 nativespace-cdp sshd[3641079]: Invalid user oracle from 91.103.252.1 port 51128
Sep  8 13:37:40 nativespace-cdp sshd[3641079]: input_userauth_request: invalid user oracle [preauth]
Sep  8 13:37:40 nativespace-cdp sshd[3641079]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:37:40 nativespace-cdp sshd[3641079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.103.252.1
Sep  8 13:37:41 nativespace-cdp sshd[3641076]: Failed password for invalid user adonis from 67.207.94.128 port 43074 ssh2
Sep  8 13:37:41 nativespace-cdp sshd[3641076]: Received disconnect from 67.207.94.128 port 43074:11: Bye Bye [preauth]
Sep  8 13:37:41 nativespace-cdp sshd[3641076]: Disconnected from 67.207.94.128 port 43074 [preauth]
Sep  8 13:37:42 nativespace-cdp sshd[3641079]: Failed password for invalid user oracle from 91.103.252.1 port 51128 ssh2
Sep  8 13:37:49 nativespace-cdp sshd[3641147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.40.73.192  user=root
Sep  8 13:37:49 nativespace-cdp sshd[3641147]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:37:51 nativespace-cdp sshd[3641147]: Failed password for root from 20.40.73.192 port 34022 ssh2
Sep  8 13:37:51 nativespace-cdp sshd[3641147]: Received disconnect from 20.40.73.192 port 34022:11: Bye Bye [preauth]
Sep  8 13:37:51 nativespace-cdp sshd[3641147]: Disconnected from 20.40.73.192 port 34022 [preauth]
Sep  8 13:38:21 nativespace-cdp sshd[3641323]: Invalid user tuo from 159.89.173.71 port 46172
Sep  8 13:38:21 nativespace-cdp sshd[3641323]: input_userauth_request: invalid user tuo [preauth]
Sep  8 13:38:21 nativespace-cdp sshd[3641323]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:38:21 nativespace-cdp sshd[3641323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.173.71
Sep  8 13:38:22 nativespace-cdp sshd[3641323]: Failed password for invalid user tuo from 159.89.173.71 port 46172 ssh2
Sep  8 13:38:22 nativespace-cdp sshd[3641323]: Received disconnect from 159.89.173.71 port 46172:11: Bye Bye [preauth]
Sep  8 13:38:22 nativespace-cdp sshd[3641323]: Disconnected from 159.89.173.71 port 46172 [preauth]
Sep  8 13:38:44 nativespace-cdp sshd[3641397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.40.73.192  user=root
Sep  8 13:38:44 nativespace-cdp sshd[3641397]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:38:47 nativespace-cdp sshd[3641397]: Failed password for root from 20.40.73.192 port 43288 ssh2
Sep  8 13:39:46 nativespace-cdp sshd[3641609]: Connection closed by 87.236.176.149 port 43159 [preauth]
Sep  8 13:39:46 nativespace-cdp sshd[3641595]: Did not receive identification string from 87.236.176.149 port 49737
Sep  8 13:41:33 nativespace-cdp sshd[3642435]: Connection closed by 159.100.136.21 port 37984 [preauth]
Sep  8 13:41:55 nativespace-cdp sshd[3642484]: Connection closed by 103.130.214.174 port 39608 [preauth]
Sep  8 13:43:01 nativespace-cdp sshd[3642648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.214.174  user=root
Sep  8 13:43:01 nativespace-cdp sshd[3642648]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 13:43:03 nativespace-cdp sshd[3642648]: Failed password for root from 103.130.214.174 port 40008 ssh2
Sep  8 13:43:05 nativespace-cdp sshd[3642648]: Received disconnect from 103.130.214.174 port 40008:11: Bye Bye [preauth]
Sep  8 13:43:05 nativespace-cdp sshd[3642648]: Disconnected from 103.130.214.174 port 40008 [preauth]
Sep  8 13:44:11 nativespace-cdp sshd[3642929]: Invalid user cust from 103.130.214.174 port 51464
Sep  8 13:44:11 nativespace-cdp sshd[3642929]: input_userauth_request: invalid user cust [preauth]
Sep  8 13:44:11 nativespace-cdp sshd[3642929]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 13:44:11 nativespace-cdp sshd[3642929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.214.174
Sep  8 13:44:13 nativespace-cdp sshd[3642929]: Failed password for invalid user cust from 103.130.214.174 port 51464 ssh2
Sep  8 13:46:35 nativespace-cdp sshd[3643498]: Connection closed by 159.100.136.21 port 47566 [preauth]
Sep  8 13:51:33 nativespace-cdp sshd[3644514]: Connection closed by 159.100.136.21 port 56862 [preauth]
Sep  8 13:56:35 nativespace-cdp sshd[3645844]: Connection closed by 159.100.136.21 port 38032 [preauth]
Sep  8 14:01:34 nativespace-cdp sshd[3647005]: Connection closed by 159.100.136.21 port 47202 [preauth]
Sep  8 14:06:33 nativespace-cdp sshd[3648076]: Connection closed by 159.100.136.21 port 56906 [preauth]
Sep  8 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:40 nativespace-cdp sudo[3648662]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:40 nativespace-cdp sudo[3648667]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:42 nativespace-cdp sudo[3648673]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 14:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:42 nativespace-cdp sudo[3648678]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 14:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:46 nativespace-cdp sudo[3648684]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 14:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:46 nativespace-cdp sudo[3648708]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:47 nativespace-cdp sudo[3648713]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:47 nativespace-cdp sudo[3648719]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:47 nativespace-cdp sudo[3648724]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:47 nativespace-cdp sudo[3648730]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:47 nativespace-cdp sudo[3648735]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 14:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:52 nativespace-cdp sudo[3648755]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 14:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:52 nativespace-cdp sudo[3648761]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bedfords user-2=bemadonn user-3=newstoda user-4=belle user-5=ggaaorgu user-6=nstriton user-7=brighto1 user-8=oneoarco user-9=battlere user-10=vivienn1 user-11=firstre2 user-12=askhform user-13=stuartge user-14=innovat1 user-15=nativene user-16=skyfirec user-17=alexadmin user-18=costestimatorco user-19=clarkass user-20=firstrel user-21=highlegh user-22=southlon user-23=firstred user-24=firstres user-25=ultbcrra user-26=jonhartl user-27=seftvta user-28=coursemc user-29=opaiscyx user-30=ianrayne user-31=accooper user-32=thqkgnbz user-33=connectedshoppin user-34=elecleis user-35=milloyco user-36=gilpin user-37=fetch user-38=carsinyo user-39=putterfi user-40=hubmaster user-41=wilsonsw user-42=megacards user-43=musorguk user-44=lakesan1 user-45=brmrjxl user-46=atestord user-47=sarafoundation
Sep  8 14:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=strathar user-49=hhdugcor user-50=lbhyisi user-51=magichat user-52=martsblo user-53=ptkxhsbt user-54=dickemery123 user-55=ulsukarm user-56=markward user-57=foundation user-58=booff user-59=lbscrmod user-60=maflemin user-61=vantagep user-62=athenare user-63=connect9 user-64=agproduc user-65=still user-66=leereyn1 user-67=stephani user-68=jarvisin user-69=theblack user-70=hodgesonweb user-71=spectrum user-72=crrtipdl user-73=sosevalu user-74=bakery user-75=nove user-76=boldover user-77=kategilpin user-78=dancinggardener user-79=stagingerris user-80=ladburyp user-81=design user-82=what user-83=tstardom user-84=oubpgvbx user-85=nvihkvu user-86=havantho user-87=cath user-88=sketchy user-89=mcdermos user-90=chrisdal user-91=david user-92=nbhavers user-93=careers user-94=tomandle user-95=jennimil user-96=branko user-97=hodgsonmail user-98=ranxterc user-99=outdoorc user-100=romaldki user-101=lucy
Sep  8 14:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=attlebor user-103=onlycont user-104=isleofwi user-105=smrszyqg user-106=barbersh user-107=tigerlet user-108=nomistakes user-109=hidden user-110=foods user-111=leftie user-112=health2045 user-113=fortunaz user-114=nscdp user-115=putterfc user-116=firstre5 user-117=steakbridieme user-118=donnychicago user-119=philmcph user-120=ctedorgu user-121=lkpier user-122=hirefootballgame user-123=courseme user-124=eugincou user-125=ninejimm user-126=reliable user-127=cambria1 user-128=cathski user-129=cwsocial user-130=howardon user-131=pugwash user-132=paulmca1 user-133=zebrapho user-134=bwppodcast user-135=steve user-136=asandcoc user-137=sibtoncc user-138=darkstar user-139=eatspam user-140=beauty user-141=dhyana user-142=fawcettd user-143=burydropin user-144=nsceres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  8 14:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 14:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:54 nativespace-cdp sudo[3648768]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 14:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:54 nativespace-cdp sudo[3648781]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ku02js50L0SSf0CZ.~
Sep  8 14:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:54 nativespace-cdp sudo[3648787]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ku02js50L0SSf0CZ.~'
Sep  8 14:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:54 nativespace-cdp sudo[3648792]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Ku02js50L0SSf0CZ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 14:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:54 nativespace-cdp sudo[3648798]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 14:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:55 nativespace-cdp sudo[3648803]: pam_unix(sudo:session): session closed for user root
Sep  8 14:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 14:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 14:09:57 nativespace-cdp sudo[3648825]: pam_unix(sudo:session): session closed for user root
Sep  8 14:11:33 nativespace-cdp sshd[3649258]: Connection closed by 159.100.136.21 port 38272 [preauth]
Sep  8 14:16:33 nativespace-cdp sshd[3650592]: Connection closed by 159.100.136.21 port 47884 [preauth]
Sep  8 14:21:34 nativespace-cdp sshd[3651569]: Connection closed by 159.100.136.21 port 56948 [preauth]
Sep  8 14:26:35 nativespace-cdp sshd[3652690]: Connection closed by 159.100.136.21 port 36692 [preauth]
Sep  8 14:31:33 nativespace-cdp sshd[3653788]: Connection closed by 159.100.136.21 port 45098 [preauth]
Sep  8 14:36:34 nativespace-cdp sshd[3654835]: Connection closed by 159.100.136.21 port 54536 [preauth]
Sep  8 14:41:35 nativespace-cdp sshd[3656179]: Connection closed by 159.100.136.21 port 34800 [preauth]
Sep  8 14:46:24 nativespace-cdp sshd[3657323]: Invalid user alma from 161.35.66.235 port 34472
Sep  8 14:46:24 nativespace-cdp sshd[3657323]: input_userauth_request: invalid user alma [preauth]
Sep  8 14:46:24 nativespace-cdp sshd[3657323]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 14:46:24 nativespace-cdp sshd[3657323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.66.235
Sep  8 14:46:26 nativespace-cdp sshd[3657323]: Failed password for invalid user alma from 161.35.66.235 port 34472 ssh2
Sep  8 14:46:26 nativespace-cdp sshd[3657323]: Received disconnect from 161.35.66.235 port 34472:11: Bye Bye [preauth]
Sep  8 14:46:26 nativespace-cdp sshd[3657323]: Disconnected from 161.35.66.235 port 34472 [preauth]
Sep  8 14:46:33 nativespace-cdp sshd[3657354]: Connection closed by 159.100.136.21 port 43298 [preauth]
Sep  8 14:51:33 nativespace-cdp sshd[3658364]: Connection closed by 159.100.136.21 port 51922 [preauth]
Sep  8 14:52:01 nativespace-cdp sshd[3658420]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.196.164.156  user=root
Sep  8 14:52:01 nativespace-cdp sshd[3658420]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 14:52:03 nativespace-cdp sshd[3658420]: Failed password for root from 91.196.164.156 port 39544 ssh2
Sep  8 14:52:03 nativespace-cdp sshd[3658420]: Received disconnect from 91.196.164.156 port 39544:11: Bye Bye [preauth]
Sep  8 14:52:03 nativespace-cdp sshd[3658420]: Disconnected from 91.196.164.156 port 39544 [preauth]
Sep  8 14:54:13 nativespace-cdp sshd[3659031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.66.235  user=root
Sep  8 14:54:13 nativespace-cdp sshd[3659031]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 14:54:15 nativespace-cdp sshd[3659031]: Failed password for root from 161.35.66.235 port 57228 ssh2
Sep  8 14:54:16 nativespace-cdp sshd[3659031]: Received disconnect from 161.35.66.235 port 57228:11: Bye Bye [preauth]
Sep  8 14:54:16 nativespace-cdp sshd[3659031]: Disconnected from 161.35.66.235 port 57228 [preauth]
Sep  8 14:56:07 nativespace-cdp sshd[3659582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.196.164.156  user=root
Sep  8 14:56:07 nativespace-cdp sshd[3659582]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 14:56:09 nativespace-cdp sshd[3659582]: Failed password for root from 91.196.164.156 port 41658 ssh2
Sep  8 14:56:09 nativespace-cdp sshd[3659582]: Received disconnect from 91.196.164.156 port 41658:11: Bye Bye [preauth]
Sep  8 14:56:09 nativespace-cdp sshd[3659582]: Disconnected from 91.196.164.156 port 41658 [preauth]
Sep  8 14:56:33 nativespace-cdp sshd[3659989]: Connection closed by 159.100.136.21 port 33130 [preauth]
Sep  8 14:56:42 nativespace-cdp sshd[3660022]: Invalid user test from 161.35.66.235 port 37444
Sep  8 14:56:42 nativespace-cdp sshd[3660022]: input_userauth_request: invalid user test [preauth]
Sep  8 14:56:42 nativespace-cdp sshd[3660022]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 14:56:42 nativespace-cdp sshd[3660022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.66.235
Sep  8 14:56:42 nativespace-cdp sshd[3660026]: Invalid user ppr from 91.196.164.156 port 42326
Sep  8 14:56:42 nativespace-cdp sshd[3660026]: input_userauth_request: invalid user ppr [preauth]
Sep  8 14:56:42 nativespace-cdp sshd[3660026]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 14:56:42 nativespace-cdp sshd[3660026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.196.164.156
Sep  8 14:56:44 nativespace-cdp sshd[3660022]: Failed password for invalid user test from 161.35.66.235 port 37444 ssh2
Sep  8 14:56:44 nativespace-cdp sshd[3660022]: Received disconnect from 161.35.66.235 port 37444:11: Bye Bye [preauth]
Sep  8 14:56:44 nativespace-cdp sshd[3660022]: Disconnected from 161.35.66.235 port 37444 [preauth]
Sep  8 14:56:44 nativespace-cdp sshd[3660026]: Failed password for invalid user ppr from 91.196.164.156 port 42326 ssh2
Sep  8 14:56:44 nativespace-cdp sshd[3660026]: Received disconnect from 91.196.164.156 port 42326:11: Bye Bye [preauth]
Sep  8 14:56:44 nativespace-cdp sshd[3660026]: Disconnected from 91.196.164.156 port 42326 [preauth]
Sep  8 15:01:37 nativespace-cdp sshd[3661183]: Connection closed by 159.100.136.21 port 42674 [preauth]
Sep  8 15:06:33 nativespace-cdp sshd[3662136]: Connection closed by 159.100.136.21 port 51962 [preauth]
Sep  8 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:35 nativespace-cdp sudo[3662681]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:35 nativespace-cdp sudo[3662685]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:36 nativespace-cdp sudo[3662690]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:36 nativespace-cdp sudo[3662697]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:38 nativespace-cdp sudo[3662703]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 15:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:38 nativespace-cdp sudo[3662715]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:39 nativespace-cdp sudo[3662720]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:39 nativespace-cdp sudo[3662724]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:39 nativespace-cdp sudo[3662729]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:39 nativespace-cdp sudo[3662735]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:39 nativespace-cdp sudo[3662740]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:46 nativespace-cdp sudo[3662767]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:47 nativespace-cdp sudo[3662773]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=coursemc user-2=opaiscyx user-3=firstres user-4=seftvta user-5=jonhartl user-6=ultbcrra user-7=southlon user-8=highlegh user-9=firstred user-10=costestimatorco user-11=clarkass user-12=firstrel user-13=carsinyo user-14=fetch user-15=hubmaster user-16=putterfi user-17=elecleis user-18=milloyco user-19=gilpin user-20=thqkgnbz user-21=connectedshoppin user-22=ianrayne user-23=accooper user-24=battlere user-25=oneoarco user-26=firstre2 user-27=vivienn1 user-28=brighto1 user-29=nstriton user-30=bemadonn user-31=belle user-32=ggaaorgu user-33=newstoda user-34=bedfords user-35=skyfirec user-36=alexadmin user-37=nativene user-38=stuartge user-39=askhform user-40=innovat1 user-41=maflemin user-42=lbscrmod user-43=athenare user-44=connect9 user-45=vantagep user-46=booff user-47=markward user-48=foundation
Sep  8 15:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=hodgesonweb user-51=theblack user-52=spectrum user-53=jarvisin user-54=leereyn1 user-55=stephani user-56=still user-57=agproduc user-58=sarafoundation user-59=atestord user-60=strathar user-61=lakesan1 user-62=brmrjxl user-63=musorguk user-64=megacards user-65=wilsonsw user-66=ptkxhsbt user-67=dickemery123 user-68=martsblo user-69=magichat user-70=lbhyisi user-71=hhdugcor user-72=jennimil user-73=tomandle user-74=careers user-75=nbhavers user-76=david user-77=mcdermos user-78=chrisdal user-79=onlycont user-80=attlebor user-81=lucy user-82=romaldki user-83=branko user-84=ranxterc user-85=hodgsonmail user-86=outdoorc user-87=boldover user-88=nove user-89=sosevalu user-90=crrtipdl user-91=bakery user-92=nvihkvu user-93=sketchy user-94=cath user-95=havantho user-96=what user-97=oubpgvbx user-98=tstardom user-99=design user-100=kategilpin user-101=ladburyp user-102=dancinggardener
Sep  8 15:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=stagingerris user-104=asandcoc user-105=sibtoncc user-106=steve user-107=zebrapho user-108=bwppodcast user-109=nsceres user-110=burydropin user-111=fawcettd user-112=dhyana user-113=eatspam user-114=darkstar user-115=beauty user-116=philmcph user-117=ctedorgu user-118=firstre5 user-119=steakbridieme user-120=donnychicago user-121=lkpier user-122=health2045 user-123=fortunaz user-124=foods user-125=leftie user-126=putterfc user-127=nscdp user-128=barbersh user-129=tigerlet user-130=hidden user-131=nomistakes user-132=isleofwi user-133=smrszyqg user-134=paulmca1 user-135=howardon user-136=pugwash user-137=cwsocial user-138=ninejimm user-139=reliable user-140=cambria1 user-141=cathski user-142=courseme user-143=eugincou user-144=hirefootballgame feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 15:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 15:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:48 nativespace-cdp sudo[3662783]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 15:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:48 nativespace-cdp sudo[3662790]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rMqAbLt4MhYGMrO8.~
Sep  8 15:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:48 nativespace-cdp sudo[3662795]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rMqAbLt4MhYGMrO8.~'
Sep  8 15:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:48 nativespace-cdp sudo[3662799]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rMqAbLt4MhYGMrO8.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 15:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:48 nativespace-cdp sudo[3662805]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 15:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:48 nativespace-cdp sudo[3662810]: pam_unix(sudo:session): session closed for user root
Sep  8 15:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 15:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 15:09:55 nativespace-cdp sudo[3662850]: pam_unix(sudo:session): session closed for user root
Sep  8 15:11:33 nativespace-cdp sshd[3663580]: Connection closed by 159.100.136.21 port 60900 [preauth]
Sep  8 15:16:33 nativespace-cdp sshd[3664760]: Connection closed by 159.100.136.21 port 41948 [preauth]
Sep  8 15:21:34 nativespace-cdp sshd[3665821]: Connection closed by 159.100.136.21 port 51674 [preauth]
Sep  8 15:26:33 nativespace-cdp sshd[3666856]: Connection closed by 159.100.136.21 port 33096 [preauth]
Sep  8 15:31:35 nativespace-cdp sshd[3668308]: Connection closed by 159.100.136.21 port 42122 [preauth]
Sep  8 15:36:33 nativespace-cdp sshd[3669388]: Connection closed by 159.100.136.21 port 51248 [preauth]
Sep  8 15:41:33 nativespace-cdp sshd[3670477]: Connection closed by 159.100.136.21 port 60404 [preauth]
Sep  8 15:46:33 nativespace-cdp sshd[3671799]: Connection closed by 159.100.136.21 port 41374 [preauth]
Sep  8 15:51:33 nativespace-cdp sshd[3672756]: Connection closed by 159.100.136.21 port 50080 [preauth]
Sep  8 15:56:33 nativespace-cdp sshd[3674062]: Connection closed by 159.100.136.21 port 59726 [preauth]
Sep  8 16:01:34 nativespace-cdp sshd[3675292]: Connection closed by 159.100.136.21 port 40798 [preauth]
Sep  8 16:03:39 nativespace-cdp sshd[3675630]: Bad protocol version identification '\003' from 91.238.181.32 port 65512
Sep  8 16:06:35 nativespace-cdp sshd[3676302]: Connection closed by 159.100.136.21 port 50644 [preauth]
Sep  8 16:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 16:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:39 nativespace-cdp sudo[3676875]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 16:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:39 nativespace-cdp sudo[3676879]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 16:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:39 nativespace-cdp sudo[3676884]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 16:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:40 nativespace-cdp sudo[3676890]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 16:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:42 nativespace-cdp sudo[3676896]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:42 nativespace-cdp sudo[3676911]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:42 nativespace-cdp sudo[3676917]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:42 nativespace-cdp sudo[3676920]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:42 nativespace-cdp sudo[3676927]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:42 nativespace-cdp sudo[3676934]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:42 nativespace-cdp sudo[3676941]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 16:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:55 nativespace-cdp sudo[3677011]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 16:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:56 nativespace-cdp sudo[3677017]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=chrisdal user-4=mcdermos user-5=careers user-6=nbhavers user-7=david user-8=attlebor user-9=lucy user-10=onlycont user-11=hodgsonmail user-12=outdoorc user-13=ranxterc user-14=branko user-15=romaldki user-16=nove user-17=boldover user-18=bakery user-19=sosevalu user-20=crrtipdl user-21=oubpgvbx user-22=tstardom user-23=what user-24=sketchy user-25=cath user-26=havantho user-27=nvihkvu user-28=ladburyp user-29=stagingerris user-30=dancinggardener user-31=kategilpin user-32=design user-33=asandcoc user-34=sibtoncc user-35=bwppodcast user-36=zebrapho user-37=steve user-38=burydropin user-39=fawcettd user-40=nsceres user-41=beauty user-42=eatspam user-43=darkstar user-44=dhyana user-45=putterfc user-46=nscdp user-47=fortunaz user-48=health2045 user-49=foods
Sep  8 16:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=leftie user-51=lkpier user-52=philmcph user-53=ctedorgu user-54=steakbridieme user-55=donnychicago user-56=firstre5 user-57=isleofwi user-58=smrszyqg user-59=hidden user-60=nomistakes user-61=barbersh user-62=tigerlet user-63=cambria1 user-64=cathski user-65=ninejimm user-66=reliable user-67=howardon user-68=pugwash user-69=paulmca1 user-70=cwsocial user-71=hirefootballgame user-72=eugincou user-73=courseme user-74=jonhartl user-75=seftvta user-76=ultbcrra user-77=firstres user-78=coursemc user-79=opaiscyx user-80=clarkass user-81=firstrel user-82=costestimatorco user-83=firstred user-84=southlon user-85=highlegh user-86=milloyco user-87=gilpin user-88=elecleis user-89=putterfi user-90=hubmaster user-91=carsinyo user-92=fetch user-93=accooper user-94=ianrayne user-95=connectedshoppin user-96=thqkgnbz user-97=brighto1 user-98=nstriton user-99=firstre2 user-100=vivienn1 user-101=battlere user-102=oneoarco
Sep  8 16:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=ggaaorgu user-105=belle user-106=newstoda user-107=bemadonn user-108=alexadmin user-109=skyfirec user-110=innovat1 user-111=askhform user-112=stuartge user-113=nativene user-114=markward user-115=booff user-116=foundation user-117=athenare user-118=connect9 user-119=vantagep user-120=maflemin user-121=lbscrmod user-122=ulsukarm user-123=jarvisin user-124=spectrum user-125=theblack user-126=hodgesonweb user-127=still user-128=agproduc user-129=stephani user-130=leereyn1 user-131=brmrjxl user-132=lakesan1 user-133=strathar user-134=sarafoundation user-135=atestord user-136=wilsonsw user-137=musorguk user-138=megacards user-139=martsblo user-140=dickemery123 user-141=ptkxhsbt user-142=lbhyisi user-143=hhdugcor user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 16:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:56 nativespace-cdp sudo[3677023]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:57 nativespace-cdp sudo[3677030]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-P0IWi4Knpkvbg9vY.~
Sep  8 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:57 nativespace-cdp sudo[3677036]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-P0IWi4Knpkvbg9vY.~'
Sep  8 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:57 nativespace-cdp sudo[3677040]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-P0IWi4Knpkvbg9vY.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:57 nativespace-cdp sudo[3677046]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:57 nativespace-cdp sudo[3677051]: pam_unix(sudo:session): session closed for user root
Sep  8 16:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 16:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 16:09:58 nativespace-cdp sudo[3677075]: pam_unix(sudo:session): session closed for user root
Sep  8 16:11:34 nativespace-cdp sshd[3677741]: Connection closed by 159.100.136.21 port 59914 [preauth]
Sep  8 16:16:33 nativespace-cdp sshd[3679054]: Connection closed by 159.100.136.21 port 41158 [preauth]
Sep  8 16:21:34 nativespace-cdp sshd[3680273]: Connection closed by 159.100.136.21 port 50306 [preauth]
Sep  8 16:26:33 nativespace-cdp sshd[3681371]: Connection closed by 159.100.136.21 port 59352 [preauth]
Sep  8 16:31:33 nativespace-cdp sshd[3682846]: Connection closed by 159.100.136.21 port 40584 [preauth]
Sep  8 16:36:33 nativespace-cdp sshd[3683911]: Connection closed by 159.100.136.21 port 50570 [preauth]
Sep  8 16:41:33 nativespace-cdp sshd[3685237]: Connection closed by 159.100.136.21 port 58694 [preauth]
Sep  8 16:46:33 nativespace-cdp sshd[3686269]: Connection closed by 159.100.136.21 port 39842 [preauth]
Sep  8 16:51:33 nativespace-cdp sshd[3687272]: Connection closed by 159.100.136.21 port 49080 [preauth]
Sep  8 16:56:34 nativespace-cdp sshd[3688586]: Connection closed by 159.100.136.21 port 58328 [preauth]
Sep  8 17:01:33 nativespace-cdp sshd[3689854]: Connection closed by 159.100.136.21 port 38956 [preauth]
Sep  8 17:06:33 nativespace-cdp sshd[3690901]: Connection closed by 159.100.136.21 port 47252 [preauth]
Sep  8 17:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 17:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:09:35 nativespace-cdp sudo[3691461]: pam_unix(sudo:session): session closed for user root
Sep  8 17:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 17:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:09:35 nativespace-cdp sudo[3691473]: pam_unix(sudo:session): session closed for user root
Sep  8 17:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 17:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:09:35 nativespace-cdp sudo[3691478]: pam_unix(sudo:session): session closed for user root
Sep  8 17:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 17:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:09:36 nativespace-cdp sudo[3691518]: pam_unix(sudo:session): session closed for user root
Sep  8 17:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 17:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:00 nativespace-cdp sudo[3691528]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:00 nativespace-cdp sudo[3691598]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:00 nativespace-cdp sudo[3691603]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:00 nativespace-cdp sudo[3691607]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:00 nativespace-cdp sudo[3691612]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:00 nativespace-cdp sudo[3691617]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:00 nativespace-cdp sudo[3691624]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 17:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:02 nativespace-cdp sudo[3691746]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 17:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:03 nativespace-cdp sudo[3691750]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=romaldki user-2=branko user-3=hodgsonmail user-4=ranxterc user-5=outdoorc user-6=onlycont user-7=lucy user-8=attlebor user-9=david user-10=careers user-11=nbhavers user-12=mcdermos user-13=chrisdal user-14=jennimil user-15=tomandle user-16=design user-17=kategilpin user-18=stagingerris user-19=dancinggardener user-20=ladburyp user-21=nvihkvu user-22=havantho user-23=sketchy user-24=cath user-25=what user-26=oubpgvbx user-27=tstardom user-28=crrtipdl user-29=sosevalu user-30=bakery user-31=boldover user-32=nove user-33=dhyana user-34=darkstar user-35=eatspam user-36=beauty user-37=nsceres user-38=fawcettd user-39=burydropin user-40=steve user-41=zebrapho user-42=bwppodcast user-43=asandcoc user-44=sibtoncc user-45=courseme user-46=eugincou user-47=hirefootballgame user-48=cwsocial
Sep  8 17:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=paulmca1 user-50=howardon user-51=pugwash user-52=ninejimm user-53=reliable user-54=cathski user-55=cambria1 user-56=tigerlet user-57=barbersh user-58=nomistakes user-59=hidden user-60=smrszyqg user-61=isleofwi user-62=steakbridieme user-63=firstre5 user-64=donnychicago user-65=ctedorgu user-66=philmcph user-67=lkpier user-68=leftie user-69=foods user-70=health2045 user-71=fortunaz user-72=nscdp user-73=putterfc user-74=thqkgnbz user-75=connectedshoppin user-76=ianrayne user-77=accooper user-78=fetch user-79=carsinyo user-80=hubmaster user-81=putterfi user-82=elecleis user-83=gilpin user-84=milloyco user-85=highlegh user-86=southlon user-87=firstred user-88=costestimatorco user-89=clarkass user-90=firstrel user-91=coursemc user-92=opaiscyx user-93=firstres user-94=ultbcrra user-95=seftvta user-96=jonhartl user-97=nativene user-98=askhform user-99=stuartge user-100=innovat1 user-101=skyfirec
Sep  8 17:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=alexadmin user-103=bemadonn user-104=newstoda user-105=belle user-106=ggaaorgu user-107=bedfords user-108=oneoarco user-109=battlere user-110=vivienn1 user-111=firstre2 user-112=nstriton user-113=brighto1 user-114=leereyn1 user-115=stephani user-116=agproduc user-117=still user-118=hodgesonweb user-119=theblack user-120=spectrum user-121=jarvisin user-122=ulsukarm user-123=lbscrmod user-124=maflemin user-125=vantagep user-126=connect9 user-127=athenare user-128=foundation user-129=markward user-130=booff user-131=magichat user-132=hhdugcor user-133=lbhyisi user-134=ptkxhsbt user-135=dickemery123 user-136=martsblo user-137=megacards user-138=musorguk user-139=wilsonsw user-140=atestord user-141=sarafoundation user-142=strathar user-143=lakesan1 user-144=brmrjxl feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  8 17:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 17:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:03 nativespace-cdp sudo[3691760]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:04 nativespace-cdp sudo[3691768]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-q3cnG8SQ1iUvFja1.~
Sep  8 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:04 nativespace-cdp sudo[3691771]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-q3cnG8SQ1iUvFja1.~'
Sep  8 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:04 nativespace-cdp sudo[3691774]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-q3cnG8SQ1iUvFja1.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:04 nativespace-cdp sudo[3691778]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:04 nativespace-cdp sudo[3691781]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 17:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 17:10:05 nativespace-cdp sudo[3691804]: pam_unix(sudo:session): session closed for user root
Sep  8 17:10:51 nativespace-cdp sshd[3691967]: Accepted publickey for root from 185.67.178.249 port 49040 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  8 17:10:51 nativespace-cdp sshd[3691967]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  8 17:11:33 nativespace-cdp sshd[3692232]: Connection closed by 159.100.136.21 port 56604 [preauth]
Sep  8 17:14:06 nativespace-cdp sshd[3691967]: Received disconnect from 185.67.178.249 port 49040:11: Normal Shutdown
Sep  8 17:14:06 nativespace-cdp sshd[3691967]: Disconnected from 185.67.178.249 port 49040
Sep  8 17:14:06 nativespace-cdp sshd[3691967]: pam_unix(sshd:session): session closed for user root
Sep  8 17:16:33 nativespace-cdp sshd[3693649]: Connection closed by 159.100.136.21 port 37746 [preauth]
Sep  8 17:21:33 nativespace-cdp sshd[3694645]: Connection closed by 159.100.136.21 port 46552 [preauth]
Sep  8 17:26:33 nativespace-cdp sshd[3695938]: Connection closed by 159.100.136.21 port 55660 [preauth]
Sep  8 17:31:33 nativespace-cdp sshd[3697103]: Connection closed by 159.100.136.21 port 36692 [preauth]
Sep  8 17:36:33 nativespace-cdp sshd[3698219]: Connection closed by 159.100.136.21 port 46306 [preauth]
Sep  8 17:41:37 nativespace-cdp sshd[3699405]: Connection closed by 159.100.136.21 port 55274 [preauth]
Sep  8 17:46:33 nativespace-cdp sshd[3700976]: Connection closed by 159.100.136.21 port 36460 [preauth]
Sep  8 17:51:34 nativespace-cdp sshd[3702030]: Connection closed by 159.100.136.21 port 45752 [preauth]
Sep  8 17:56:33 nativespace-cdp sshd[3703450]: Connection closed by 159.100.136.21 port 55464 [preauth]
Sep  8 18:01:33 nativespace-cdp sshd[3704558]: Connection closed by 159.100.136.21 port 36650 [preauth]
Sep  8 18:06:34 nativespace-cdp sshd[3705570]: Connection closed by 159.100.136.21 port 46054 [preauth]
Sep  8 18:08:16 nativespace-cdp sshd[3705850]: Accepted publickey for root from 185.67.178.249 port 46558 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  8 18:08:16 nativespace-cdp sshd[3705850]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  8 18:08:43 nativespace-cdp sshd[3705850]: pam_unix(sshd:session): session closed for user root
Sep  8 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:39 nativespace-cdp sudo[3706142]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:39 nativespace-cdp sudo[3706147]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:40 nativespace-cdp sudo[3706152]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 18:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:40 nativespace-cdp sudo[3706160]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 18:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:42 nativespace-cdp sudo[3706166]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:42 nativespace-cdp sudo[3706181]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:42 nativespace-cdp sudo[3706186]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:42 nativespace-cdp sudo[3706190]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:42 nativespace-cdp sudo[3706195]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:42 nativespace-cdp sudo[3706202]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:42 nativespace-cdp sudo[3706208]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 18:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:49 nativespace-cdp sudo[3706231]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 18:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:50 nativespace-cdp sudo[3706237]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=firstres user-2=ultbcrra user-3=jonhartl user-4=seftvta user-5=opaiscyx user-6=coursemc user-7=costestimatorco user-8=firstrel user-9=clarkass user-10=highlegh user-11=southlon user-12=firstred user-13=elecleis user-14=milloyco user-15=gilpin user-16=fetch user-17=carsinyo user-18=hubmaster user-19=putterfi user-20=ianrayne user-21=accooper user-22=thqkgnbz user-23=connectedshoppin user-24=nstriton user-25=brighto1 user-26=oneoarco user-27=battlere user-28=vivienn1 user-29=firstre2 user-30=bedfords user-31=bemadonn user-32=newstoda user-33=ggaaorgu user-34=belle user-35=alexadmin user-36=skyfirec user-37=stuartge user-38=askhform user-39=innovat1 user-40=nativene user-41=foundation user-42=markward user-43=booff user-44=lbscrmod user-45=maflemin user-46=vantagep user-47=athenare user-48=connect9
Sep  8 18:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=jarvisin user-51=theblack user-52=hodgesonweb user-53=spectrum user-54=agproduc user-55=still user-56=leereyn1 user-57=stephani user-58=lakesan1 user-59=brmrjxl user-60=atestord user-61=sarafoundation user-62=strathar user-63=wilsonsw user-64=megacards user-65=musorguk user-66=martsblo user-67=ptkxhsbt user-68=dickemery123 user-69=hhdugcor user-70=lbhyisi user-71=magichat user-72=tomandle user-73=jennimil user-74=mcdermos user-75=chrisdal user-76=david user-77=careers user-78=nbhavers user-79=lucy user-80=attlebor user-81=onlycont user-82=branko user-83=outdoorc user-84=hodgsonmail user-85=ranxterc user-86=romaldki user-87=nove user-88=boldover user-89=crrtipdl user-90=sosevalu user-91=bakery user-92=what user-93=oubpgvbx user-94=tstardom user-95=nvihkvu user-96=havantho user-97=cath user-98=sketchy user-99=kategilpin user-100=stagingerris user-101=dancinggardener user-102=ladburyp
Sep  8 18:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=design user-104=asandcoc user-105=sibtoncc user-106=zebrapho user-107=bwppodcast user-108=steve user-109=fawcettd user-110=burydropin user-111=nsceres user-112=darkstar user-113=eatspam user-114=beauty user-115=dhyana user-116=foods user-117=leftie user-118=fortunaz user-119=health2045 user-120=nscdp user-121=putterfc user-122=steakbridieme user-123=firstre5 user-124=donnychicago user-125=ctedorgu user-126=philmcph user-127=lkpier user-128=smrszyqg user-129=isleofwi user-130=barbersh user-131=tigerlet user-132=nomistakes user-133=hidden user-134=reliable user-135=ninejimm user-136=cambria1 user-137=cathski user-138=cwsocial user-139=pugwash user-140=howardon user-141=paulmca1 user-142=hirefootballgame user-143=courseme user-144=eugincou feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 18:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 18:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:51 nativespace-cdp sudo[3706244]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 18:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:51 nativespace-cdp sudo[3706253]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xrwB5S2WdxpAKU8n.~
Sep  8 18:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:51 nativespace-cdp sudo[3706258]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xrwB5S2WdxpAKU8n.~'
Sep  8 18:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:51 nativespace-cdp sudo[3706262]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xrwB5S2WdxpAKU8n.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 18:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:51 nativespace-cdp sudo[3706268]: pam_unix(sudo:session): session closed for user root
Sep  8 18:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 18:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:09:51 nativespace-cdp sudo[3706273]: pam_unix(sudo:session): session closed for user root
Sep  8 18:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 18:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 18:10:02 nativespace-cdp sudo[3706508]: pam_unix(sudo:session): session closed for user root
Sep  8 18:11:35 nativespace-cdp sshd[3706836]: Connection closed by 159.100.136.21 port 54740 [preauth]
Sep  8 18:16:35 nativespace-cdp sshd[3707960]: Connection closed by 159.100.136.21 port 34934 [preauth]
Sep  8 18:21:33 nativespace-cdp sshd[3709135]: Connection closed by 159.100.136.21 port 44060 [preauth]
Sep  8 18:26:34 nativespace-cdp sshd[3710460]: Connection closed by 159.100.136.21 port 53808 [preauth]
Sep  8 18:31:35 nativespace-cdp sshd[3711496]: Connection closed by 159.100.136.21 port 33700 [preauth]
Sep  8 18:36:33 nativespace-cdp sshd[3712640]: Connection closed by 159.100.136.21 port 42912 [preauth]
Sep  8 18:41:37 nativespace-cdp sshd[3713764]: Connection closed by 159.100.136.21 port 51296 [preauth]
Sep  8 18:46:36 nativespace-cdp sshd[3715081]: Connection closed by 159.100.136.21 port 60750 [preauth]
Sep  8 18:51:34 nativespace-cdp sshd[3716184]: Connection closed by 159.100.136.21 port 41592 [preauth]
Sep  8 18:56:36 nativespace-cdp sshd[3717372]: Connection closed by 159.100.136.21 port 51400 [preauth]
Sep  8 19:01:33 nativespace-cdp sshd[3718623]: Connection closed by 159.100.136.21 port 60344 [preauth]
Sep  8 19:06:37 nativespace-cdp sshd[3719812]: Connection closed by 159.100.136.21 port 41442 [preauth]
Sep  8 19:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 19:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:45 nativespace-cdp sudo[3720424]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 19:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:45 nativespace-cdp sudo[3720429]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 19:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:48 nativespace-cdp sudo[3720436]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:48 nativespace-cdp sudo[3720446]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:52 nativespace-cdp sudo[3720452]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 19:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:52 nativespace-cdp sudo[3720464]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 19:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:52 nativespace-cdp sudo[3720470]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 19:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:52 nativespace-cdp sudo[3720475]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 19:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:52 nativespace-cdp sudo[3720480]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 19:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:52 nativespace-cdp sudo[3720486]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 19:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:52 nativespace-cdp sudo[3720491]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:54 nativespace-cdp sudo[3720504]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:56 nativespace-cdp sudo[3720510]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=dickemery123 user-3=ptkxhsbt user-4=hhdugcor user-5=lbhyisi user-6=magichat user-7=brmrjxl user-8=lakesan1 user-9=strathar user-10=atestord user-11=sarafoundation user-12=wilsonsw user-13=megacards user-14=musorguk user-15=jarvisin user-16=spectrum user-17=theblack user-18=hodgesonweb user-19=agproduc user-20=still user-21=stephani user-22=leereyn1 user-23=markward user-24=booff user-25=foundation user-26=vantagep user-27=connect9 user-28=athenare user-29=lbscrmod user-30=maflemin user-31=ulsukarm user-32=alexadmin user-33=skyfirec user-34=innovat1 user-35=askhform user-36=stuartge user-37=nativene user-38=nstriton user-39=brighto1 user-40=vivienn1 user-41=firstre2 user-42=oneoarco user-43=battlere user-44=bedfords user-45=newstoda user-46=ggaaorgu user-47=belle user-48=bemadonn
Sep  8 19:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=gilpin user-50=milloyco user-51=elecleis user-52=putterfi user-53=hubmaster user-54=fetch user-55=carsinyo user-56=accooper user-57=ianrayne user-58=connectedshoppin user-59=thqkgnbz user-60=ultbcrra user-61=jonhartl user-62=seftvta user-63=firstres user-64=coursemc user-65=opaiscyx user-66=clarkass user-67=firstrel user-68=costestimatorco user-69=firstred user-70=highlegh user-71=southlon user-72=cathski user-73=cambria1 user-74=reliable user-75=ninejimm user-76=cwsocial user-77=howardon user-78=paulmca1 user-79=pugwash user-80=hirefootballgame user-81=eugincou user-82=courseme user-83=nscdp user-84=putterfc user-85=foods user-86=leftie user-87=health2045 user-88=fortunaz user-89=lkpier user-90=steakbridieme user-91=firstre5 user-92=donnychicago user-93=philmcph user-94=ctedorgu user-95=isleofwi user-96=smrszyqg user-97=nomistakes user-98=hidden user-99=tigerlet user-100=barbersh user-101=fawcettd
Sep  8 19:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=burydropin user-103=nsceres user-104=beauty user-105=darkstar user-106=eatspam user-107=dhyana user-108=asandcoc user-109=sibtoncc user-110=bwppodcast user-111=zebrapho user-112=steve user-113=oubpgvbx user-114=tstardom user-115=what user-116=havantho user-117=sketchy user-118=cath user-119=nvihkvu user-120=dancinggardener user-121=stagingerris user-122=ladburyp user-123=kategilpin user-124=design user-125=nove user-126=boldover user-127=bakery user-128=crrtipdl user-129=sosevalu user-130=lucy user-131=attlebor user-132=onlycont user-133=hodgsonmail user-134=ranxterc user-135=outdoorc user-136=branko user-137=romaldki user-138=tomandle user-139=jennimil user-140=chrisdal user-141=mcdermos user-142=david user-143=careers user-144=nbhavers feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 19:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:58 nativespace-cdp sudo[3720522]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 19:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:58 nativespace-cdp sudo[3720532]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6uEfSzvZ5ZyvLwRm.~
Sep  8 19:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:58 nativespace-cdp sudo[3720537]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6uEfSzvZ5ZyvLwRm.~'
Sep  8 19:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:59 nativespace-cdp sudo[3720541]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-6uEfSzvZ5ZyvLwRm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 19:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:59 nativespace-cdp sudo[3720547]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 19:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:09:59 nativespace-cdp sudo[3720553]: pam_unix(sudo:session): session closed for user root
Sep  8 19:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep  8 19:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:10:04 nativespace-cdp sudo[3720559]: pam_unix(sudo:session): session closed for user root
Sep  8 19:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 19:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 19:10:07 nativespace-cdp sudo[3720713]: pam_unix(sudo:session): session closed for user root
Sep  8 19:11:33 nativespace-cdp sshd[3721182]: Connection closed by 159.100.136.21 port 50286 [preauth]
Sep  8 19:16:35 nativespace-cdp sshd[3722493]: Connection closed by 159.100.136.21 port 59230 [preauth]
Sep  8 19:21:33 nativespace-cdp sshd[3723604]: Connection closed by 159.100.136.21 port 40156 [preauth]
Sep  8 19:26:33 nativespace-cdp sshd[3724830]: Connection closed by 159.100.136.21 port 49616 [preauth]
Sep  8 19:29:05 nativespace-cdp sshd[3725492]: Accepted publickey for root from 185.67.178.249 port 44074 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  8 19:29:05 nativespace-cdp sshd[3725492]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  8 19:31:09 nativespace-cdp sshd[3726183]: Accepted publickey for root from 185.67.178.249 port 39608 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep  8 19:31:09 nativespace-cdp sshd[3726183]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep  8 19:31:28 nativespace-cdp sshd[3725492]: Received disconnect from 185.67.178.249 port 44074:11: Normal Shutdown
Sep  8 19:31:28 nativespace-cdp sshd[3725492]: Disconnected from 185.67.178.249 port 44074
Sep  8 19:31:28 nativespace-cdp sshd[3725492]: pam_unix(sshd:session): session closed for user root
Sep  8 19:31:32 nativespace-cdp sshd[3726183]: Received disconnect from 185.67.178.249 port 39608:11: Normal Shutdown
Sep  8 19:31:32 nativespace-cdp sshd[3726183]: Disconnected from 185.67.178.249 port 39608
Sep  8 19:31:32 nativespace-cdp sshd[3726183]: pam_unix(sshd:session): session closed for user root
Sep  8 19:31:33 nativespace-cdp sshd[3726298]: Connection closed by 159.100.136.21 port 59116 [preauth]
Sep  8 19:36:33 nativespace-cdp sshd[3727344]: Connection closed by 159.100.136.21 port 40454 [preauth]
Sep  8 19:41:33 nativespace-cdp sshd[3728551]: Connection closed by 159.100.136.21 port 48824 [preauth]
Sep  8 19:46:33 nativespace-cdp sshd[3729778]: Connection closed by 159.100.136.21 port 58406 [preauth]
Sep  8 19:51:34 nativespace-cdp sshd[3730858]: Connection closed by 159.100.136.21 port 39830 [preauth]
Sep  8 19:56:33 nativespace-cdp sshd[3732644]: Connection closed by 159.100.136.21 port 49410 [preauth]
Sep  8 20:01:33 nativespace-cdp sshd[3733970]: Connection closed by 159.100.136.21 port 58934 [preauth]
Sep  8 20:06:33 nativespace-cdp sshd[3734916]: Connection closed by 159.100.136.21 port 40706 [preauth]
Sep  8 20:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 20:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:39 nativespace-cdp sudo[3735878]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 20:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:39 nativespace-cdp sudo[3735882]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 20:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:40 nativespace-cdp sudo[3735887]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:41 nativespace-cdp sudo[3735895]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 20:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:47 nativespace-cdp sudo[3735901]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:47 nativespace-cdp sudo[3735919]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:47 nativespace-cdp sudo[3735924]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:47 nativespace-cdp sudo[3735928]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:47 nativespace-cdp sudo[3735933]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:47 nativespace-cdp sudo[3735940]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:47 nativespace-cdp sudo[3735945]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:59 nativespace-cdp sudo[3735969]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 20:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:09:59 nativespace-cdp sudo[3735975]: pam_unix(sudo:session): session closed for user root
Sep  8 20:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bwppodcast user-2=zebrapho user-3=steve user-4=asandcoc user-5=sibtoncc user-6=beauty user-7=eatspam user-8=darkstar user-9=dhyana user-10=burydropin user-11=fawcettd user-12=nsceres user-13=isleofwi user-14=smrszyqg user-15=hidden user-16=nomistakes user-17=barbersh user-18=tigerlet user-19=putterfc user-20=nscdp user-21=fortunaz user-22=health2045 user-23=foods user-24=leftie user-25=lkpier user-26=philmcph user-27=ctedorgu user-28=firstre5 user-29=donnychicago user-30=steakbridieme user-31=hirefootballgame user-32=eugincou user-33=courseme user-34=cambria1 user-35=cathski user-36=reliable user-37=ninejimm user-38=paulmca1 user-39=howardon user-40=pugwash user-41=cwsocial user-42=chrisdal user-43=mcdermos user-44=nbhavers user-45=careers user-46=david user-47=tomandle user-48=jennimil
Sep  8 20:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=outdoorc user-50=hodgsonmail user-51=ranxterc user-52=branko user-53=romaldki user-54=attlebor user-55=lucy user-56=onlycont user-57=bakery user-58=sosevalu user-59=crrtipdl user-60=nove user-61=boldover user-62=ladburyp user-63=stagingerris user-64=dancinggardener user-65=kategilpin user-66=design user-67=tstardom user-68=oubpgvbx user-69=what user-70=cath user-71=sketchy user-72=havantho user-73=nvihkvu user-74=ulsukarm user-75=foundation user-76=booff user-77=markward user-78=athenare user-79=connect9 user-80=vantagep user-81=maflemin user-82=lbscrmod user-83=still user-84=agproduc user-85=stephani user-86=leereyn1 user-87=jarvisin user-88=spectrum user-89=hodgesonweb user-90=theblack user-91=wilsonsw user-92=musorguk user-93=megacards user-94=brmrjxl user-95=lakesan1 user-96=strathar user-97=sarafoundation user-98=atestord user-99=lbhyisi user-100=hhdugcor user-101=magichat user-102=martsblo
Sep  8 20:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=dickemery123 user-104=ptkxhsbt user-105=clarkass user-106=firstrel user-107=costestimatorco user-108=firstred user-109=southlon user-110=highlegh user-111=seftvta user-112=jonhartl user-113=ultbcrra user-114=firstres user-115=coursemc user-116=opaiscyx user-117=accooper user-118=ianrayne user-119=connectedshoppin user-120=thqkgnbz user-121=milloyco user-122=gilpin user-123=elecleis user-124=putterfi user-125=hubmaster user-126=carsinyo user-127=fetch user-128=bedfords user-129=ggaaorgu user-130=belle user-131=newstoda user-132=bemadonn user-133=brighto1 user-134=nstriton user-135=firstre2 user-136=vivienn1 user-137=battlere user-138=oneoarco user-139=innovat1 user-140=stuartge user-141=askhform user-142=nativene user-143=skyfirec user-144=alexadmin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 20:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 20:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:10:00 nativespace-cdp sudo[3735982]: pam_unix(sudo:session): session closed for user root
Sep  8 20:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 20:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:10:00 nativespace-cdp sudo[3735990]: pam_unix(sudo:session): session closed for user root
Sep  8 20:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fC3ruS1t8v2kEsr3.~
Sep  8 20:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:10:00 nativespace-cdp sudo[3735995]: pam_unix(sudo:session): session closed for user root
Sep  8 20:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fC3ruS1t8v2kEsr3.~'
Sep  8 20:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:10:00 nativespace-cdp sudo[3735999]: pam_unix(sudo:session): session closed for user root
Sep  8 20:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fC3ruS1t8v2kEsr3.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 20:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:10:00 nativespace-cdp sudo[3736005]: pam_unix(sudo:session): session closed for user root
Sep  8 20:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 20:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:10:00 nativespace-cdp sudo[3736010]: pam_unix(sudo:session): session closed for user root
Sep  8 20:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 20:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 20:10:10 nativespace-cdp sudo[3736160]: pam_unix(sudo:session): session closed for user root
Sep  8 20:11:36 nativespace-cdp sshd[3736636]: Connection closed by 159.100.136.21 port 49080 [preauth]
Sep  8 20:16:33 nativespace-cdp sshd[3737999]: Connection closed by 159.100.136.21 port 57566 [preauth]
Sep  8 20:21:33 nativespace-cdp sshd[3739015]: Connection closed by 159.100.136.21 port 39120 [preauth]
Sep  8 20:26:33 nativespace-cdp sshd[3740089]: Connection closed by 159.100.136.21 port 49074 [preauth]
Sep  8 20:31:34 nativespace-cdp sshd[3741480]: Connection closed by 159.100.136.21 port 58014 [preauth]
Sep  8 20:36:34 nativespace-cdp sshd[3742652]: Connection closed by 159.100.136.21 port 39862 [preauth]
Sep  8 20:41:33 nativespace-cdp sshd[3743920]: Connection closed by 159.100.136.21 port 49468 [preauth]
Sep  8 20:46:33 nativespace-cdp sshd[3745330]: Connection closed by 159.100.136.21 port 58794 [preauth]
Sep  8 20:56:33 nativespace-cdp sshd[3747590]: Connection closed by 159.100.136.21 port 49836 [preauth]
Sep  8 21:01:35 nativespace-cdp sshd[3749213]: Connection closed by 159.100.136.21 port 59682 [preauth]
Sep  8 21:06:33 nativespace-cdp sshd[3750371]: Connection closed by 159.100.136.21 port 41794 [preauth]
Sep  8 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:44 nativespace-cdp sudo[3750920]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:44 nativespace-cdp sudo[3750924]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:46 nativespace-cdp sudo[3750930]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 21:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:46 nativespace-cdp sudo[3750937]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 21:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:50 nativespace-cdp sudo[3750943]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 21:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:50 nativespace-cdp sudo[3750956]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 21:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:50 nativespace-cdp sudo[3750961]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 21:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:50 nativespace-cdp sudo[3750965]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 21:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:50 nativespace-cdp sudo[3750970]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 21:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:50 nativespace-cdp sudo[3750976]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 21:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:50 nativespace-cdp sudo[3750981]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 21:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:55 nativespace-cdp sudo[3750998]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 21:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:57 nativespace-cdp sudo[3751004]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=dickemery123 user-3=ptkxhsbt user-4=lbhyisi user-5=hhdugcor user-6=magichat user-7=lakesan1 user-8=brmrjxl user-9=strathar user-10=sarafoundation user-11=atestord user-12=wilsonsw user-13=musorguk user-14=megacards user-15=jarvisin user-16=spectrum user-17=theblack user-18=hodgesonweb user-19=still user-20=agproduc user-21=stephani user-22=leereyn1 user-23=markward user-24=foundation user-25=booff user-26=connect9 user-27=athenare user-28=vantagep user-29=maflemin user-30=lbscrmod user-31=ulsukarm user-32=alexadmin user-33=skyfirec user-34=innovat1 user-35=askhform user-36=stuartge user-37=nativene user-38=brighto1 user-39=nstriton user-40=firstre2 user-41=vivienn1 user-42=battlere user-43=oneoarco user-44=bedfords user-45=ggaaorgu user-46=belle user-47=newstoda user-48=bemadonn
Sep  8 21:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=gilpin user-50=milloyco user-51=elecleis user-52=putterfi user-53=hubmaster user-54=carsinyo user-55=fetch user-56=accooper user-57=ianrayne user-58=connectedshoppin user-59=thqkgnbz user-60=jonhartl user-61=seftvta user-62=ultbcrra user-63=firstres user-64=opaiscyx user-65=coursemc user-66=clarkass user-67=firstrel user-68=costestimatorco user-69=firstred user-70=southlon user-71=highlegh user-72=cathski user-73=cambria1 user-74=reliable user-75=ninejimm user-76=howardon user-77=pugwash user-78=paulmca1 user-79=cwsocial user-80=hirefootballgame user-81=eugincou user-82=courseme user-83=putterfc user-84=nscdp user-85=fortunaz user-86=health2045 user-87=leftie user-88=foods user-89=lkpier user-90=ctedorgu user-91=philmcph user-92=firstre5 user-93=steakbridieme user-94=donnychicago user-95=smrszyqg user-96=isleofwi user-97=hidden user-98=nomistakes user-99=tigerlet user-100=barbersh user-101=burydropin
Sep  8 21:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=fawcettd user-103=nsceres user-104=beauty user-105=eatspam user-106=darkstar user-107=dhyana user-108=asandcoc user-109=sibtoncc user-110=bwppodcast user-111=zebrapho user-112=steve user-113=tstardom user-114=oubpgvbx user-115=what user-116=cath user-117=sketchy user-118=havantho user-119=nvihkvu user-120=ladburyp user-121=dancinggardener user-122=stagingerris user-123=kategilpin user-124=design user-125=nove user-126=boldover user-127=bakery user-128=sosevalu user-129=crrtipdl user-130=attlebor user-131=lucy user-132=onlycont user-133=ranxterc user-134=hodgsonmail user-135=outdoorc user-136=branko user-137=romaldki user-138=tomandle user-139=jennimil user-140=chrisdal user-141=mcdermos user-142=nbhavers user-143=careers user-144=david feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 21:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 21:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:58 nativespace-cdp sudo[3751017]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 21:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:58 nativespace-cdp sudo[3751025]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cdawaBjpf8g12XZY.~
Sep  8 21:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:59 nativespace-cdp sudo[3751032]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cdawaBjpf8g12XZY.~'
Sep  8 21:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:59 nativespace-cdp sudo[3751036]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cdawaBjpf8g12XZY.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 21:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:59 nativespace-cdp sudo[3751042]: pam_unix(sudo:session): session closed for user root
Sep  8 21:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 21:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:09:59 nativespace-cdp sudo[3751047]: pam_unix(sudo:session): session closed for user root
Sep  8 21:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 21:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:10:00 nativespace-cdp sudo[3751069]: pam_unix(sudo:session): session closed for user root
Sep  8 21:11:33 nativespace-cdp sshd[3751537]: Connection closed by 159.100.136.21 port 51744 [preauth]
Sep  8 21:16:33 nativespace-cdp sshd[3752838]: Connection closed by 159.100.136.21 port 33580 [preauth]
Sep  8 21:21:33 nativespace-cdp sshd[3754005]: Connection closed by 159.100.136.21 port 43288 [preauth]
Sep  8 21:26:33 nativespace-cdp sshd[3755196]: Connection closed by 159.100.136.21 port 52706 [preauth]
Sep  8 21:31:35 nativespace-cdp sshd[3756477]: Connection closed by 159.100.136.21 port 33866 [preauth]
Sep  8 21:36:35 nativespace-cdp sshd[3757552]: Connection closed by 159.100.136.21 port 43764 [preauth]
Sep  8 21:37:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 21:37:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:37:14 nativespace-cdp sudo[3757798]: pam_unix(sudo:session): session closed for user root
Sep  8 21:37:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status agproduc
Sep  8 21:37:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:37:16 nativespace-cdp sudo[3757802]: pam_unix(sudo:session): session closed for user root
Sep  8 21:37:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 21:37:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:37:20 nativespace-cdp sudo[3757903]: pam_unix(sudo:session): session closed for user root
Sep  8 21:37:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status cwsocial
Sep  8 21:37:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:37:21 nativespace-cdp sudo[3757916]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 21:39:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:39 nativespace-cdp sudo[3758657]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status darkstar
Sep  8 21:39:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:41 nativespace-cdp sudo[3758693]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 21:39:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:44 nativespace-cdp sudo[3758721]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status foundation
Sep  8 21:39:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:45 nativespace-cdp sudo[3758725]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 21:39:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:46 nativespace-cdp sudo[3758739]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status ianrayne
Sep  8 21:39:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:46 nativespace-cdp sudo[3758743]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 21:39:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:48 nativespace-cdp sudo[3758755]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status mcdermos
Sep  8 21:39:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:48 nativespace-cdp sudo[3758760]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 21:39:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:53 nativespace-cdp sudo[3758779]: pam_unix(sudo:session): session closed for user root
Sep  8 21:39:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status mcdermos
Sep  8 21:39:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 21:39:53 nativespace-cdp sudo[3758784]: pam_unix(sudo:session): session closed for user root
Sep  8 21:41:34 nativespace-cdp sshd[3759488]: Connection closed by 159.100.136.21 port 53450 [preauth]
Sep  8 21:46:33 nativespace-cdp sshd[3760674]: Connection closed by 159.100.136.21 port 34802 [preauth]
Sep  8 21:51:36 nativespace-cdp sshd[3761846]: Connection closed by 159.100.136.21 port 44418 [preauth]
Sep  8 21:56:33 nativespace-cdp sshd[3763031]: Connection closed by 159.100.136.21 port 53736 [preauth]
Sep  8 22:01:33 nativespace-cdp sshd[3764224]: Connection closed by 159.100.136.21 port 34610 [preauth]
Sep  8 22:06:33 nativespace-cdp sshd[3765116]: Connection closed by 159.100.136.21 port 43566 [preauth]
Sep  8 22:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 22:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:46 nativespace-cdp sudo[3766128]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 22:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:46 nativespace-cdp sudo[3766132]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 22:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:47 nativespace-cdp sudo[3766137]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 22:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:47 nativespace-cdp sudo[3766143]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 22:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:49 nativespace-cdp sudo[3766149]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 22:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:49 nativespace-cdp sudo[3766159]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 22:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:49 nativespace-cdp sudo[3766164]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 22:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:49 nativespace-cdp sudo[3766168]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 22:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:49 nativespace-cdp sudo[3766174]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 22:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:49 nativespace-cdp sudo[3766179]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 22:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:49 nativespace-cdp sudo[3766185]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:51 nativespace-cdp sudo[3766204]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:51 nativespace-cdp sudo[3766213]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ianrayne user-2=accooper user-3=thqkgnbz user-4=connectedshoppin user-5=elecleis user-6=gilpin user-7=milloyco user-8=fetch user-9=carsinyo user-10=putterfi user-11=hubmaster user-12=costestimatorco user-13=clarkass user-14=firstrel user-15=highlegh user-16=southlon user-17=firstred user-18=firstres user-19=ultbcrra user-20=seftvta user-21=jonhartl user-22=coursemc user-23=opaiscyx user-24=askhform user-25=stuartge user-26=innovat1 user-27=nativene user-28=alexadmin user-29=skyfirec user-30=bedfords user-31=bemadonn user-32=newstoda user-33=belle user-34=ggaaorgu user-35=nstriton user-36=brighto1 user-37=oneoarco user-38=battlere user-39=vivienn1 user-40=firstre2 user-41=agproduc user-42=still user-43=leereyn1 user-44=stephani user-45=jarvisin user-46=theblack user-47=hodgesonweb
Sep  8 22:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=spectrum user-49=ulsukarm user-50=booff user-51=foundation user-52=markward user-53=lbscrmod user-54=maflemin user-55=vantagep user-56=connect9 user-57=athenare user-58=hhdugcor user-59=lbhyisi user-60=magichat user-61=martsblo user-62=ptkxhsbt user-63=dickemery123 user-64=wilsonsw user-65=megacards user-66=musorguk user-67=brmrjxl user-68=lakesan1 user-69=atestord user-70=sarafoundation user-71=strathar user-72=branko user-73=hodgsonmail user-74=ranxterc user-75=outdoorc user-76=romaldki user-77=lucy user-78=attlebor user-79=onlycont user-80=mcdermos user-81=chrisdal user-82=david user-83=careers user-84=nbhavers user-85=tomandle user-86=jennimil user-87=kategilpin user-88=stagingerris user-89=dancinggardener user-90=ladburyp user-91=design user-92=what user-93=tstardom user-94=oubpgvbx user-95=nvihkvu user-96=havantho user-97=cath user-98=sketchy user-99=crrtipdl user-100=sosevalu user-101=bakery
Sep  8 22:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=nove user-103=boldover user-104=darkstar user-105=eatspam user-106=beauty user-107=dhyana user-108=fawcettd user-109=burydropin user-110=nsceres user-111=zebrapho user-112=bwppodcast user-113=steve user-114=sibtoncc user-115=asandcoc user-116=hirefootballgame user-117=courseme user-118=eugincou user-119=ninejimm user-120=reliable user-121=cathski user-122=cambria1 user-123=cwsocial user-124=paulmca1 user-125=howardon user-126=pugwash user-127=smrszyqg user-128=isleofwi user-129=tigerlet user-130=barbersh user-131=nomistakes user-132=hidden user-133=leftie user-134=foods user-135=fortunaz user-136=health2045 user-137=nscdp user-138=putterfc user-139=firstre5 user-140=steakbridieme user-141=donnychicago user-142=philmcph user-143=ctedorgu user-144=lkpier feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 22:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:52 nativespace-cdp sudo[3766219]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 22:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:53 nativespace-cdp sudo[3766232]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FR4jOSxsCQbDf46t.~
Sep  8 22:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:53 nativespace-cdp sudo[3766237]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FR4jOSxsCQbDf46t.~'
Sep  8 22:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:53 nativespace-cdp sudo[3766241]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FR4jOSxsCQbDf46t.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 22:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:53 nativespace-cdp sudo[3766247]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 22:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:53 nativespace-cdp sudo[3766252]: pam_unix(sudo:session): session closed for user root
Sep  8 22:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 22:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 22:09:54 nativespace-cdp sudo[3766281]: pam_unix(sudo:session): session closed for user root
Sep  8 22:11:33 nativespace-cdp sshd[3766745]: Connection closed by 159.100.136.21 port 51722 [preauth]
Sep  8 22:16:36 nativespace-cdp sshd[3768031]: Connection closed by 159.100.136.21 port 32950 [preauth]
Sep  8 22:21:33 nativespace-cdp sshd[3769818]: Connection closed by 159.100.136.21 port 41756 [preauth]
Sep  8 22:26:36 nativespace-cdp sshd[3770828]: Connection closed by 159.100.136.21 port 51214 [preauth]
Sep  8 22:31:33 nativespace-cdp sshd[3772276]: Connection closed by 159.100.136.21 port 60564 [preauth]
Sep  8 22:36:33 nativespace-cdp sshd[3773330]: Connection closed by 159.100.136.21 port 41910 [preauth]
Sep  8 22:41:33 nativespace-cdp sshd[3774778]: Connection closed by 159.100.136.21 port 50070 [preauth]
Sep  8 22:46:34 nativespace-cdp sshd[3775898]: Connection closed by 159.100.136.21 port 59468 [preauth]
Sep  8 22:51:33 nativespace-cdp sshd[3776985]: Connection closed by 159.100.136.21 port 39676 [preauth]
Sep  8 22:56:33 nativespace-cdp sshd[3778295]: Connection closed by 159.100.136.21 port 49480 [preauth]
Sep  8 23:01:34 nativespace-cdp sshd[3779705]: Connection closed by 159.100.136.21 port 58972 [preauth]
Sep  8 23:06:33 nativespace-cdp sshd[3780802]: Connection closed by 159.100.136.21 port 40516 [preauth]
Sep  8 23:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  8 23:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:09:46 nativespace-cdp sudo[3781420]: pam_unix(sudo:session): session closed for user root
Sep  8 23:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  8 23:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:09:46 nativespace-cdp sudo[3781424]: pam_unix(sudo:session): session closed for user root
Sep  8 23:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  8 23:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:09:47 nativespace-cdp sudo[3781430]: pam_unix(sudo:session): session closed for user root
Sep  8 23:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  8 23:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:09:47 nativespace-cdp sudo[3781436]: pam_unix(sudo:session): session closed for user root
Sep  8 23:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  8 23:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:10 nativespace-cdp sudo[3781443]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  8 23:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:10 nativespace-cdp sudo[3781606]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  8 23:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:10 nativespace-cdp sudo[3781609]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  8 23:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:10 nativespace-cdp sudo[3781612]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  8 23:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:10 nativespace-cdp sudo[3781615]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  8 23:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:10 nativespace-cdp sudo[3781618]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  8 23:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:10 nativespace-cdp sudo[3781621]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  8 23:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:15 nativespace-cdp sudo[3781638]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  8 23:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:15 nativespace-cdp sudo[3781642]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=cwsocial user-2=howardon user-3=pugwash user-4=paulmca1 user-5=ninejimm user-6=reliable user-7=cambria1 user-8=cathski user-9=courseme user-10=eugincou user-11=hirefootballgame user-12=steakbridieme user-13=donnychicago user-14=firstre5 user-15=ctedorgu user-16=philmcph user-17=lkpier user-18=foods user-19=leftie user-20=fortunaz user-21=health2045 user-22=nscdp user-23=putterfc user-24=tigerlet user-25=barbersh user-26=nomistakes user-27=hidden user-28=smrszyqg user-29=isleofwi user-30=nsceres user-31=fawcettd user-32=burydropin user-33=dhyana user-34=darkstar user-35=eatspam user-36=beauty user-37=asandcoc user-38=sibtoncc user-39=steve user-40=zebrapho user-41=bwppodcast user-42=nvihkvu user-43=havantho user-44=cath user-45=sketchy user-46=what user-47=oubpgvbx user-48=tstardom user-49=design
Sep  8 23:10:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=kategilpin user-51=stagingerris user-52=dancinggardener user-53=ladburyp user-54=boldover user-55=nove user-56=crrtipdl user-57=sosevalu user-58=bakery user-59=onlycont user-60=lucy user-61=attlebor user-62=romaldki user-63=branko user-64=outdoorc user-65=hodgsonmail user-66=ranxterc user-67=jennimil user-68=tomandle user-69=david user-70=careers user-71=nbhavers user-72=mcdermos user-73=chrisdal user-74=ptkxhsbt user-75=dickemery123 user-76=martsblo user-77=magichat user-78=hhdugcor user-79=lbhyisi user-80=atestord user-81=sarafoundation user-82=strathar user-83=lakesan1 user-84=brmrjxl user-85=megacards user-86=musorguk user-87=wilsonsw user-88=hodgesonweb user-89=theblack user-90=spectrum user-91=jarvisin user-92=leereyn1 user-93=stephani user-94=agproduc user-95=still user-96=lbscrmod user-97=maflemin user-98=vantagep user-99=athenare user-100=connect9 user-101=markward user-102=booff
Sep  8 23:10:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=foundation user-104=ulsukarm user-105=alexadmin user-106=skyfirec user-107=nativene user-108=stuartge user-109=askhform user-110=innovat1 user-111=oneoarco user-112=battlere user-113=vivienn1 user-114=firstre2 user-115=nstriton user-116=brighto1 user-117=bemadonn user-118=newstoda user-119=ggaaorgu user-120=belle user-121=bedfords user-122=fetch user-123=carsinyo user-124=hubmaster user-125=putterfi user-126=elecleis user-127=gilpin user-128=milloyco user-129=thqkgnbz user-130=connectedshoppin user-131=ianrayne user-132=accooper user-133=coursemc user-134=opaiscyx user-135=firstres user-136=ultbcrra user-137=jonhartl user-138=seftvta user-139=highlegh user-140=southlon user-141=firstred user-142=costestimatorco user-143=firstrel user-144=clarkass feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  8 23:10:15 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  8 23:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:16 nativespace-cdp sudo[3781647]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 23:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:16 nativespace-cdp sudo[3781651]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fZiFy1P9ZMT0Ylm9.~
Sep  8 23:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:16 nativespace-cdp sudo[3781655]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fZiFy1P9ZMT0Ylm9.~'
Sep  8 23:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:16 nativespace-cdp sudo[3781658]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fZiFy1P9ZMT0Ylm9.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  8 23:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:16 nativespace-cdp sudo[3781662]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  8 23:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:16 nativespace-cdp sudo[3781665]: pam_unix(sudo:session): session closed for user root
Sep  8 23:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  8 23:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  8 23:10:17 nativespace-cdp sudo[3781683]: pam_unix(sudo:session): session closed for user root
Sep  8 23:11:34 nativespace-cdp sshd[3781934]: Connection closed by 159.100.136.21 port 49738 [preauth]
Sep  8 23:16:33 nativespace-cdp sshd[3783234]: Connection closed by 159.100.136.21 port 59064 [preauth]
Sep  8 23:20:48 nativespace-cdp sshd[3784085]: Invalid user nima from 104.248.128.33 port 33738
Sep  8 23:20:48 nativespace-cdp sshd[3784085]: input_userauth_request: invalid user nima [preauth]
Sep  8 23:20:48 nativespace-cdp sshd[3784085]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 23:20:48 nativespace-cdp sshd[3784085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.128.33
Sep  8 23:20:50 nativespace-cdp sshd[3784085]: Failed password for invalid user nima from 104.248.128.33 port 33738 ssh2
Sep  8 23:20:50 nativespace-cdp sshd[3784085]: Received disconnect from 104.248.128.33 port 33738:11: Bye Bye [preauth]
Sep  8 23:20:50 nativespace-cdp sshd[3784085]: Disconnected from 104.248.128.33 port 33738 [preauth]
Sep  8 23:21:33 nativespace-cdp sshd[3784193]: Connection closed by 159.100.136.21 port 39958 [preauth]
Sep  8 23:22:05 nativespace-cdp sshd[3784382]: Invalid user nurul from 104.248.128.33 port 43466
Sep  8 23:22:05 nativespace-cdp sshd[3784382]: input_userauth_request: invalid user nurul [preauth]
Sep  8 23:22:05 nativespace-cdp sshd[3784382]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 23:22:05 nativespace-cdp sshd[3784382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.128.33
Sep  8 23:22:08 nativespace-cdp sshd[3784382]: Failed password for invalid user nurul from 104.248.128.33 port 43466 ssh2
Sep  8 23:22:11 nativespace-cdp sshd[3784382]: Received disconnect from 104.248.128.33 port 43466:11: Bye Bye [preauth]
Sep  8 23:22:11 nativespace-cdp sshd[3784382]: Disconnected from 104.248.128.33 port 43466 [preauth]
Sep  8 23:22:46 nativespace-cdp sshd[3784501]: Invalid user sftpuser from 104.248.128.33 port 46638
Sep  8 23:22:46 nativespace-cdp sshd[3784501]: input_userauth_request: invalid user sftpuser [preauth]
Sep  8 23:22:46 nativespace-cdp sshd[3784501]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 23:22:46 nativespace-cdp sshd[3784501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.128.33
Sep  8 23:22:48 nativespace-cdp sshd[3784501]: Failed password for invalid user sftpuser from 104.248.128.33 port 46638 ssh2
Sep  8 23:22:48 nativespace-cdp sshd[3784501]: Received disconnect from 104.248.128.33 port 46638:11: Bye Bye [preauth]
Sep  8 23:22:48 nativespace-cdp sshd[3784501]: Disconnected from 104.248.128.33 port 46638 [preauth]
Sep  8 23:23:30 nativespace-cdp sshd[3784636]: Invalid user rock from 144.34.212.238 port 60360
Sep  8 23:23:30 nativespace-cdp sshd[3784636]: input_userauth_request: invalid user rock [preauth]
Sep  8 23:23:30 nativespace-cdp sshd[3784636]: pam_unix(sshd:auth): check pass; user unknown
Sep  8 23:23:30 nativespace-cdp sshd[3784636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.34.212.238
Sep  8 23:23:31 nativespace-cdp sshd[3784636]: Failed password for invalid user rock from 144.34.212.238 port 60360 ssh2
Sep  8 23:23:31 nativespace-cdp sshd[3784636]: Received disconnect from 144.34.212.238 port 60360:11: Bye Bye [preauth]
Sep  8 23:23:31 nativespace-cdp sshd[3784636]: Disconnected from 144.34.212.238 port 60360 [preauth]
Sep  8 23:26:33 nativespace-cdp sshd[3785269]: Connection closed by 159.100.136.21 port 48770 [preauth]
Sep  8 23:26:57 nativespace-cdp sshd[3785366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.34.212.238  user=root
Sep  8 23:26:57 nativespace-cdp sshd[3785366]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 23:27:00 nativespace-cdp sshd[3785366]: Failed password for root from 144.34.212.238 port 43604 ssh2
Sep  8 23:27:00 nativespace-cdp sshd[3785366]: Received disconnect from 144.34.212.238 port 43604:11: Bye Bye [preauth]
Sep  8 23:27:00 nativespace-cdp sshd[3785366]: Disconnected from 144.34.212.238 port 43604 [preauth]
Sep  8 23:27:49 nativespace-cdp sshd[3785692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.34.212.238  user=root
Sep  8 23:27:49 nativespace-cdp sshd[3785692]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  8 23:27:51 nativespace-cdp sshd[3785692]: Failed password for root from 144.34.212.238 port 60666 ssh2
Sep  8 23:27:52 nativespace-cdp sshd[3785692]: Received disconnect from 144.34.212.238 port 60666:11: Bye Bye [preauth]
Sep  8 23:27:52 nativespace-cdp sshd[3785692]: Disconnected from 144.34.212.238 port 60666 [preauth]
Sep  8 23:31:34 nativespace-cdp sshd[3786490]: Connection closed by 159.100.136.21 port 57256 [preauth]
Sep  8 23:36:33 nativespace-cdp sshd[3787546]: Connection closed by 159.100.136.21 port 38492 [preauth]
Sep  8 23:41:34 nativespace-cdp sshd[3788756]: Connection closed by 159.100.136.21 port 47840 [preauth]
Sep  8 23:46:36 nativespace-cdp sshd[3789931]: Connection closed by 159.100.136.21 port 57480 [preauth]
Sep  8 23:51:36 nativespace-cdp sshd[3790930]: Connection closed by 159.100.136.21 port 38294 [preauth]
Sep  8 23:56:34 nativespace-cdp sshd[3791975]: Connection closed by 159.100.136.21 port 47554 [preauth]
Sep  9 00:01:33 nativespace-cdp sshd[3793306]: Connection closed by 159.100.136.21 port 56584 [preauth]
Sep  9 00:06:34 nativespace-cdp sshd[3794314]: Connection closed by 159.100.136.21 port 38148 [preauth]
Sep  9 00:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 00:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:46 nativespace-cdp sudo[3794942]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 00:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:46 nativespace-cdp sudo[3794947]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 00:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:47 nativespace-cdp sudo[3794952]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 00:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:47 nativespace-cdp sudo[3794957]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 00:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:48 nativespace-cdp sudo[3794964]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 00:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:48 nativespace-cdp sudo[3794973]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 00:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:48 nativespace-cdp sudo[3794977]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 00:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:48 nativespace-cdp sudo[3794982]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 00:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:48 nativespace-cdp sudo[3794987]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 00:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:48 nativespace-cdp sudo[3794993]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 00:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:48 nativespace-cdp sudo[3794998]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 00:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:50 nativespace-cdp sudo[3795012]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 00:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:50 nativespace-cdp sudo[3795018]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=what user-2=tstardom user-3=oubpgvbx user-4=nvihkvu user-5=cath user-6=sketchy user-7=havantho user-8=kategilpin user-9=ladburyp user-10=dancinggardener user-11=stagingerris user-12=design user-13=nove user-14=boldover user-15=sosevalu user-16=crrtipdl user-17=bakery user-18=attlebor user-19=lucy user-20=onlycont user-21=branko user-22=hodgsonmail user-23=outdoorc user-24=ranxterc user-25=romaldki user-26=tomandle user-27=jennimil user-28=mcdermos user-29=chrisdal user-30=nbhavers user-31=careers user-32=david user-33=reliable user-34=ninejimm user-35=cambria1 user-36=cathski user-37=howardon user-38=paulmca1 user-39=pugwash user-40=cwsocial user-41=hirefootballgame user-42=courseme user-43=eugincou user-44=fortunaz user-45=health2045 user-46=leftie user-47=foods user-48=putterfc user-49=nscdp
Sep  9 00:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=ctedorgu user-51=philmcph user-52=firstre5 user-53=donnychicago user-54=steakbridieme user-55=lkpier user-56=smrszyqg user-57=isleofwi user-58=barbersh user-59=tigerlet user-60=hidden user-61=nomistakes user-62=burydropin user-63=fawcettd user-64=nsceres user-65=eatspam user-66=darkstar user-67=beauty user-68=dhyana user-69=sibtoncc user-70=asandcoc user-71=zebrapho user-72=bwppodcast user-73=steve user-74=alexadmin user-75=skyfirec user-76=stuartge user-77=askhform user-78=innovat1 user-79=nativene user-80=brighto1 user-81=nstriton user-82=battlere user-83=oneoarco user-84=firstre2 user-85=vivienn1 user-86=bedfords user-87=bemadonn user-88=ggaaorgu user-89=belle user-90=newstoda user-91=elecleis user-92=milloyco user-93=gilpin user-94=carsinyo user-95=fetch user-96=putterfi user-97=hubmaster user-98=ianrayne user-99=accooper user-100=thqkgnbz user-101=connectedshoppin user-102=firstres user-103=seftvta
Sep  9 00:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=jonhartl user-105=ultbcrra user-106=opaiscyx user-107=coursemc user-108=costestimatorco user-109=clarkass user-110=firstrel user-111=southlon user-112=highlegh user-113=firstred user-114=martsblo user-115=ptkxhsbt user-116=dickemery123 user-117=lbhyisi user-118=hhdugcor user-119=magichat user-120=brmrjxl user-121=lakesan1 user-122=sarafoundation user-123=atestord user-124=strathar user-125=wilsonsw user-126=musorguk user-127=megacards user-128=jarvisin user-129=hodgesonweb user-130=theblack user-131=spectrum user-132=still user-133=agproduc user-134=leereyn1 user-135=stephani user-136=markward user-137=foundation user-138=booff user-139=maflemin user-140=lbscrmod user-141=athenare user-142=connect9 user-143=vantagep user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 00:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 00:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:51 nativespace-cdp sudo[3795025]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:51 nativespace-cdp sudo[3795032]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-WFau0v47nP71DLbH.~
Sep  9 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:51 nativespace-cdp sudo[3795037]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-WFau0v47nP71DLbH.~'
Sep  9 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:51 nativespace-cdp sudo[3795041]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-WFau0v47nP71DLbH.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:51 nativespace-cdp sudo[3795047]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:51 nativespace-cdp sudo[3795052]: pam_unix(sudo:session): session closed for user root
Sep  9 00:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 00:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 00:09:52 nativespace-cdp sudo[3795073]: pam_unix(sudo:session): session closed for user root
Sep  9 00:11:33 nativespace-cdp sshd[3795471]: Connection closed by 159.100.136.21 port 47236 [preauth]
Sep  9 00:16:33 nativespace-cdp sshd[3796771]: Connection closed by 159.100.136.21 port 56874 [preauth]
Sep  9 00:21:37 nativespace-cdp sshd[3797893]: Connection closed by 159.100.136.21 port 37686 [preauth]
Sep  9 00:26:33 nativespace-cdp sshd[3799068]: Connection closed by 159.100.136.21 port 46620 [preauth]
Sep  9 00:31:36 nativespace-cdp sshd[3800078]: Connection closed by 159.100.136.21 port 55466 [preauth]
Sep  9 00:36:35 nativespace-cdp sshd[3801056]: Connection closed by 159.100.136.21 port 37110 [preauth]
Sep  9 00:41:35 nativespace-cdp sshd[3802042]: Connection closed by 159.100.136.21 port 46186 [preauth]
Sep  9 00:46:33 nativespace-cdp sshd[3803290]: Connection closed by 159.100.136.21 port 54116 [preauth]
Sep  9 00:51:36 nativespace-cdp sshd[3804234]: Connection closed by 159.100.136.21 port 34450 [preauth]
Sep  9 00:51:50 nativespace-cdp sshd[3804273]: Invalid user hh from 137.184.54.11 port 37828
Sep  9 00:51:50 nativespace-cdp sshd[3804273]: input_userauth_request: invalid user hh [preauth]
Sep  9 00:51:50 nativespace-cdp sshd[3804273]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 00:51:50 nativespace-cdp sshd[3804273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.54.11
Sep  9 00:51:52 nativespace-cdp sshd[3804273]: Failed password for invalid user hh from 137.184.54.11 port 37828 ssh2
Sep  9 00:51:52 nativespace-cdp sshd[3804273]: Received disconnect from 137.184.54.11 port 37828:11: Bye Bye [preauth]
Sep  9 00:51:52 nativespace-cdp sshd[3804273]: Disconnected from 137.184.54.11 port 37828 [preauth]
Sep  9 00:56:33 nativespace-cdp sshd[3805306]: Connection closed by 159.100.136.21 port 43724 [preauth]
Sep  9 00:56:52 nativespace-cdp sshd[3805343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.51.126.147  user=root
Sep  9 00:56:52 nativespace-cdp sshd[3805343]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 00:56:54 nativespace-cdp sshd[3805343]: Failed password for root from 158.51.126.147 port 33602 ssh2
Sep  9 00:56:54 nativespace-cdp sshd[3805343]: Received disconnect from 158.51.126.147 port 33602:11: Bye Bye [preauth]
Sep  9 00:56:54 nativespace-cdp sshd[3805343]: Disconnected from 158.51.126.147 port 33602 [preauth]
Sep  9 00:57:39 nativespace-cdp sshd[3805634]: Invalid user ndd from 54.37.153.81 port 54698
Sep  9 00:57:39 nativespace-cdp sshd[3805634]: input_userauth_request: invalid user ndd [preauth]
Sep  9 00:57:39 nativespace-cdp sshd[3805634]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 00:57:39 nativespace-cdp sshd[3805634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.153.81
Sep  9 00:57:41 nativespace-cdp sshd[3805634]: Failed password for invalid user ndd from 54.37.153.81 port 54698 ssh2
Sep  9 00:57:42 nativespace-cdp sshd[3805634]: Received disconnect from 54.37.153.81 port 54698:11: Bye Bye [preauth]
Sep  9 00:57:42 nativespace-cdp sshd[3805634]: Disconnected from 54.37.153.81 port 54698 [preauth]
Sep  9 00:59:01 nativespace-cdp sshd[3806228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.51.126.147  user=root
Sep  9 00:59:01 nativespace-cdp sshd[3806228]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 00:59:01 nativespace-cdp sshd[3806230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.96.243.175  user=root
Sep  9 00:59:01 nativespace-cdp sshd[3806230]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 00:59:03 nativespace-cdp sshd[3806228]: Failed password for root from 158.51.126.147 port 58056 ssh2
Sep  9 00:59:03 nativespace-cdp sshd[3806230]: Failed password for root from 176.96.243.175 port 50714 ssh2
Sep  9 00:59:03 nativespace-cdp sshd[3806230]: Received disconnect from 176.96.243.175 port 50714:11: Bye Bye [preauth]
Sep  9 00:59:03 nativespace-cdp sshd[3806230]: Disconnected from 176.96.243.175 port 50714 [preauth]
Sep  9 00:59:03 nativespace-cdp sshd[3806228]: Received disconnect from 158.51.126.147 port 58056:11: Bye Bye [preauth]
Sep  9 00:59:03 nativespace-cdp sshd[3806228]: Disconnected from 158.51.126.147 port 58056 [preauth]
Sep  9 00:59:04 nativespace-cdp sshd[3806248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.54.11  user=root
Sep  9 00:59:04 nativespace-cdp sshd[3806248]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 00:59:06 nativespace-cdp sshd[3806248]: Failed password for root from 137.184.54.11 port 37656 ssh2
Sep  9 00:59:06 nativespace-cdp sshd[3806248]: Received disconnect from 137.184.54.11 port 37656:11: Bye Bye [preauth]
Sep  9 00:59:06 nativespace-cdp sshd[3806248]: Disconnected from 137.184.54.11 port 37656 [preauth]
Sep  9 00:59:16 nativespace-cdp sshd[3806283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.153.81  user=root
Sep  9 00:59:16 nativespace-cdp sshd[3806283]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 00:59:18 nativespace-cdp sshd[3806283]: Failed password for root from 54.37.153.81 port 60646 ssh2
Sep  9 00:59:18 nativespace-cdp sshd[3806283]: Received disconnect from 54.37.153.81 port 60646:11: Bye Bye [preauth]
Sep  9 00:59:18 nativespace-cdp sshd[3806283]: Disconnected from 54.37.153.81 port 60646 [preauth]
Sep  9 00:59:41 nativespace-cdp sshd[3806336]: Invalid user image from 137.184.54.11 port 55246
Sep  9 00:59:41 nativespace-cdp sshd[3806336]: input_userauth_request: invalid user image [preauth]
Sep  9 00:59:41 nativespace-cdp sshd[3806336]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 00:59:41 nativespace-cdp sshd[3806336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.54.11
Sep  9 00:59:43 nativespace-cdp sshd[3806336]: Failed password for invalid user image from 137.184.54.11 port 55246 ssh2
Sep  9 00:59:49 nativespace-cdp sshd[3806377]: Invalid user webmin from 158.51.126.147 port 45394
Sep  9 00:59:49 nativespace-cdp sshd[3806377]: input_userauth_request: invalid user webmin [preauth]
Sep  9 00:59:49 nativespace-cdp sshd[3806377]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 00:59:49 nativespace-cdp sshd[3806377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.51.126.147
Sep  9 00:59:51 nativespace-cdp sshd[3806377]: Failed password for invalid user webmin from 158.51.126.147 port 45394 ssh2
Sep  9 00:59:53 nativespace-cdp sshd[3806400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.153.81  user=root
Sep  9 00:59:53 nativespace-cdp sshd[3806400]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 00:59:54 nativespace-cdp sshd[3806400]: Failed password for root from 54.37.153.81 port 52410 ssh2
Sep  9 00:59:54 nativespace-cdp sshd[3806400]: Received disconnect from 54.37.153.81 port 52410:11: Bye Bye [preauth]
Sep  9 00:59:54 nativespace-cdp sshd[3806400]: Disconnected from 54.37.153.81 port 52410 [preauth]
Sep  9 01:00:43 nativespace-cdp sshd[3806766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.96.243.175  user=root
Sep  9 01:00:43 nativespace-cdp sshd[3806766]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 01:00:44 nativespace-cdp sshd[3806766]: Failed password for root from 176.96.243.175 port 47388 ssh2
Sep  9 01:00:44 nativespace-cdp sshd[3806766]: Received disconnect from 176.96.243.175 port 47388:11: Bye Bye [preauth]
Sep  9 01:00:44 nativespace-cdp sshd[3806766]: Disconnected from 176.96.243.175 port 47388 [preauth]
Sep  9 01:01:31 nativespace-cdp sshd[3806961]: Invalid user nikolay from 176.96.243.175 port 48964
Sep  9 01:01:31 nativespace-cdp sshd[3806961]: input_userauth_request: invalid user nikolay [preauth]
Sep  9 01:01:31 nativespace-cdp sshd[3806961]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 01:01:31 nativespace-cdp sshd[3806961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.96.243.175
Sep  9 01:01:32 nativespace-cdp sshd[3806961]: Failed password for invalid user nikolay from 176.96.243.175 port 48964 ssh2
Sep  9 01:01:35 nativespace-cdp sshd[3806979]: Connection closed by 159.100.136.21 port 52902 [preauth]
Sep  9 01:01:36 nativespace-cdp sshd[3806961]: Received disconnect from 176.96.243.175 port 48964:11: Bye Bye [preauth]
Sep  9 01:01:36 nativespace-cdp sshd[3806961]: Disconnected from 176.96.243.175 port 48964 [preauth]
Sep  9 01:06:34 nativespace-cdp sshd[3808074]: Connection closed by 159.100.136.21 port 33712 [preauth]
Sep  9 01:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 01:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:46 nativespace-cdp sudo[3808623]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 01:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:46 nativespace-cdp sudo[3808627]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 01:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:47 nativespace-cdp sudo[3808630]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 01:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:47 nativespace-cdp sudo[3808633]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 01:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:48 nativespace-cdp sudo[3808637]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 01:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:48 nativespace-cdp sudo[3808645]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 01:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:48 nativespace-cdp sudo[3808648]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 01:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:48 nativespace-cdp sudo[3808651]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 01:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:48 nativespace-cdp sudo[3808654]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 01:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:48 nativespace-cdp sudo[3808657]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 01:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:48 nativespace-cdp sudo[3808660]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 01:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:54 nativespace-cdp sudo[3808675]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 01:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:55 nativespace-cdp sudo[3808679]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=seftvta user-2=jonhartl user-3=ultbcrra user-4=firstres user-5=opaiscyx user-6=coursemc user-7=clarkass user-8=firstrel user-9=costestimatorco user-10=firstred user-11=southlon user-12=highlegh user-13=gilpin user-14=milloyco user-15=elecleis user-16=putterfi user-17=hubmaster user-18=carsinyo user-19=fetch user-20=accooper user-21=ianrayne user-22=connectedshoppin user-23=thqkgnbz user-24=brighto1 user-25=nstriton user-26=firstre2 user-27=vivienn1 user-28=battlere user-29=oneoarco user-30=bedfords user-31=ggaaorgu user-32=belle user-33=newstoda user-34=bemadonn user-35=skyfirec user-36=alexadmin user-37=innovat1 user-38=askhform user-39=stuartge user-40=nativene user-41=booff user-42=foundation user-43=markward user-44=connect9 user-45=athenare user-46=vantagep user-47=maflemin user-48=lbscrmod
Sep  9 01:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=jarvisin user-51=spectrum user-52=hodgesonweb user-53=theblack user-54=still user-55=agproduc user-56=stephani user-57=leereyn1 user-58=lakesan1 user-59=brmrjxl user-60=strathar user-61=sarafoundation user-62=atestord user-63=wilsonsw user-64=musorguk user-65=megacards user-66=martsblo user-67=dickemery123 user-68=ptkxhsbt user-69=lbhyisi user-70=hhdugcor user-71=magichat user-72=tomandle user-73=jennimil user-74=chrisdal user-75=mcdermos user-76=careers user-77=nbhavers user-78=david user-79=attlebor user-80=lucy user-81=onlycont user-82=hodgsonmail user-83=ranxterc user-84=outdoorc user-85=branko user-86=romaldki user-87=nove user-88=boldover user-89=bakery user-90=sosevalu user-91=crrtipdl user-92=tstardom user-93=oubpgvbx user-94=what user-95=sketchy user-96=cath user-97=havantho user-98=nvihkvu user-99=ladburyp user-100=dancinggardener user-101=stagingerris user-102=kategilpin
Sep  9 01:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=design user-104=sibtoncc user-105=asandcoc user-106=bwppodcast user-107=zebrapho user-108=steve user-109=burydropin user-110=fawcettd user-111=nsceres user-112=beauty user-113=eatspam user-114=darkstar user-115=dhyana user-116=putterfc user-117=nscdp user-118=health2045 user-119=fortunaz user-120=leftie user-121=foods user-122=lkpier user-123=ctedorgu user-124=philmcph user-125=donnychicago user-126=firstre5 user-127=steakbridieme user-128=smrszyqg user-129=isleofwi user-130=hidden user-131=nomistakes user-132=tigerlet user-133=barbersh user-134=cambria1 user-135=cathski user-136=reliable user-137=ninejimm user-138=paulmca1 user-139=howardon user-140=pugwash user-141=cwsocial user-142=hirefootballgame user-143=eugincou user-144=courseme feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 01:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 01:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:55 nativespace-cdp sudo[3808684]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 01:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:55 nativespace-cdp sudo[3808689]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-LCeCQK5S9sSiq1fK.~
Sep  9 01:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:55 nativespace-cdp sudo[3808692]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-LCeCQK5S9sSiq1fK.~'
Sep  9 01:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:55 nativespace-cdp sudo[3808695]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-LCeCQK5S9sSiq1fK.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 01:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:55 nativespace-cdp sudo[3808699]: pam_unix(sudo:session): session closed for user root
Sep  9 01:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 01:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:09:55 nativespace-cdp sudo[3808702]: pam_unix(sudo:session): session closed for user root
Sep  9 01:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 01:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 01:10:02 nativespace-cdp sudo[3808834]: pam_unix(sudo:session): session closed for user root
Sep  9 01:11:33 nativespace-cdp sshd[3809399]: Connection closed by 159.100.136.21 port 43184 [preauth]
Sep  9 01:16:33 nativespace-cdp sshd[3811136]: Connection closed by 159.100.136.21 port 51494 [preauth]
Sep  9 01:21:33 nativespace-cdp sshd[3812048]: Connection closed by 159.100.136.21 port 59948 [preauth]
Sep  9 01:26:35 nativespace-cdp sshd[3813194]: Connection closed by 159.100.136.21 port 41578 [preauth]
Sep  9 01:31:33 nativespace-cdp sshd[3814183]: Connection closed by 159.100.136.21 port 51074 [preauth]
Sep  9 01:36:33 nativespace-cdp sshd[3815125]: Connection closed by 159.100.136.21 port 59948 [preauth]
Sep  9 01:41:34 nativespace-cdp sshd[3816377]: Connection closed by 159.100.136.21 port 39672 [preauth]
Sep  9 01:46:36 nativespace-cdp sshd[3817439]: Connection closed by 159.100.136.21 port 49412 [preauth]
Sep  9 01:51:33 nativespace-cdp sshd[3818596]: Connection closed by 159.100.136.21 port 58642 [preauth]
Sep  9 01:56:33 nativespace-cdp sshd[3819691]: Connection closed by 159.100.136.21 port 39356 [preauth]
Sep  9 02:01:33 nativespace-cdp sshd[3821208]: Connection closed by 159.100.136.21 port 48764 [preauth]
Sep  9 02:06:33 nativespace-cdp sshd[3822234]: Connection closed by 159.100.136.21 port 58306 [preauth]
Sep  9 02:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 02:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:46 nativespace-cdp sudo[3822782]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 02:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:46 nativespace-cdp sudo[3822785]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 02:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:47 nativespace-cdp sudo[3822788]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 02:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:47 nativespace-cdp sudo[3822792]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 02:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:48 nativespace-cdp sudo[3822795]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 02:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:48 nativespace-cdp sudo[3822803]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 02:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:48 nativespace-cdp sudo[3822806]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 02:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:48 nativespace-cdp sudo[3822810]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 02:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:48 nativespace-cdp sudo[3822813]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 02:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:48 nativespace-cdp sudo[3822816]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 02:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:48 nativespace-cdp sudo[3822819]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:55 nativespace-cdp sudo[3822838]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:55 nativespace-cdp sudo[3822842]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=darkstar user-2=eatspam user-3=beauty user-4=dhyana user-5=fawcettd user-6=burydropin user-7=nsceres user-8=zebrapho user-9=bwppodcast user-10=steve user-11=sibtoncc user-12=asandcoc user-13=hirefootballgame user-14=courseme user-15=eugincou user-16=ninejimm user-17=reliable user-18=cambria1 user-19=cathski user-20=cwsocial user-21=howardon user-22=paulmca1 user-23=pugwash user-24=isleofwi user-25=smrszyqg user-26=barbersh user-27=tigerlet user-28=nomistakes user-29=hidden user-30=leftie user-31=foods user-32=health2045 user-33=fortunaz user-34=nscdp user-35=putterfc user-36=donnychicago user-37=firstre5 user-38=steakbridieme user-39=ctedorgu user-40=philmcph user-41=lkpier user-42=branko user-43=outdoorc user-44=hodgsonmail user-45=ranxterc user-46=romaldki user-47=lucy user-48=attlebor
Sep  9 02:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=mcdermos user-51=chrisdal user-52=david user-53=careers user-54=nbhavers user-55=tomandle user-56=jennimil user-57=kategilpin user-58=stagingerris user-59=dancinggardener user-60=ladburyp user-61=design user-62=what user-63=tstardom user-64=oubpgvbx user-65=nvihkvu user-66=havantho user-67=sketchy user-68=cath user-69=crrtipdl user-70=sosevalu user-71=bakery user-72=nove user-73=boldover user-74=agproduc user-75=still user-76=leereyn1 user-77=stephani user-78=jarvisin user-79=theblack user-80=hodgesonweb user-81=spectrum user-82=ulsukarm user-83=markward user-84=foundation user-85=booff user-86=lbscrmod user-87=maflemin user-88=vantagep user-89=connect9 user-90=athenare user-91=hhdugcor user-92=lbhyisi user-93=magichat user-94=martsblo user-95=ptkxhsbt user-96=dickemery123 user-97=wilsonsw user-98=megacards user-99=musorguk user-100=brmrjxl user-101=lakesan1 user-102=atestord
Sep  9 02:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=sarafoundation user-104=strathar user-105=ianrayne user-106=accooper user-107=thqkgnbz user-108=connectedshoppin user-109=elecleis user-110=milloyco user-111=gilpin user-112=fetch user-113=carsinyo user-114=putterfi user-115=hubmaster user-116=costestimatorco user-117=clarkass user-118=firstrel user-119=highlegh user-120=southlon user-121=firstred user-122=firstres user-123=ultbcrra user-124=jonhartl user-125=seftvta user-126=coursemc user-127=opaiscyx user-128=stuartge user-129=askhform user-130=innovat1 user-131=nativene user-132=skyfirec user-133=alexadmin user-134=bedfords user-135=bemadonn user-136=newstoda user-137=ggaaorgu user-138=belle user-139=nstriton user-140=brighto1 user-141=oneoarco user-142=battlere user-143=vivienn1 user-144=firstre2 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 02:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 02:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:56 nativespace-cdp sudo[3822847]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:56 nativespace-cdp sudo[3822852]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8iaKKRr0uDdVG1Em.~
Sep  9 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:56 nativespace-cdp sudo[3822855]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8iaKKRr0uDdVG1Em.~'
Sep  9 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:56 nativespace-cdp sudo[3822858]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8iaKKRr0uDdVG1Em.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:56 nativespace-cdp sudo[3822864]: pam_unix(sudo:session): session closed for user root
Sep  9 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:09:56 nativespace-cdp sudo[3822869]: pam_unix(sudo:session): session closed for user root
Sep  9 02:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 02:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 02:10:01 nativespace-cdp sudo[3822897]: pam_unix(sudo:session): session closed for user root
Sep  9 02:11:33 nativespace-cdp sshd[3823356]: Connection closed by 159.100.136.21 port 37702 [preauth]
Sep  9 02:16:33 nativespace-cdp sshd[3825217]: Connection closed by 159.100.136.21 port 46856 [preauth]
Sep  9 02:21:33 nativespace-cdp sshd[3826151]: Connection closed by 159.100.136.21 port 56096 [preauth]
Sep  9 02:26:33 nativespace-cdp sshd[3827014]: Connection closed by 159.100.136.21 port 37156 [preauth]
Sep  9 02:31:33 nativespace-cdp sshd[3828290]: Connection closed by 159.100.136.21 port 46218 [preauth]
Sep  9 02:36:33 nativespace-cdp sshd[3829271]: Connection closed by 159.100.136.21 port 55786 [preauth]
Sep  9 02:41:33 nativespace-cdp sshd[3830487]: Connection closed by 159.100.136.21 port 36646 [preauth]
Sep  9 02:46:33 nativespace-cdp sshd[3831489]: Connection closed by 159.100.136.21 port 45706 [preauth]
Sep  9 02:51:35 nativespace-cdp sshd[3832639]: Connection closed by 159.100.136.21 port 53956 [preauth]
Sep  9 02:56:34 nativespace-cdp sshd[3833668]: Connection closed by 159.100.136.21 port 33998 [preauth]
Sep  9 03:01:33 nativespace-cdp sshd[3834897]: Connection closed by 159.100.136.21 port 42948 [preauth]
Sep  9 03:06:33 nativespace-cdp sshd[3835915]: Connection closed by 159.100.136.21 port 51532 [preauth]
Sep  9 03:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 03:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:47 nativespace-cdp sudo[3836503]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 03:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:47 nativespace-cdp sudo[3836506]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 03:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:48 nativespace-cdp sudo[3836509]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 03:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:48 nativespace-cdp sudo[3836513]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 03:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:49 nativespace-cdp sudo[3836516]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 03:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:49 nativespace-cdp sudo[3836523]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 03:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:49 nativespace-cdp sudo[3836526]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 03:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:49 nativespace-cdp sudo[3836529]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 03:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:49 nativespace-cdp sudo[3836532]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 03:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:49 nativespace-cdp sudo[3836535]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 03:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:49 nativespace-cdp sudo[3836539]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 03:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:51 nativespace-cdp sudo[3836552]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 03:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:51 nativespace-cdp sudo[3836556]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=chrisdal user-4=mcdermos user-5=david user-6=careers user-7=nbhavers user-8=lucy user-9=attlebor user-10=onlycont user-11=hodgsonmail user-12=outdoorc user-13=ranxterc user-14=branko user-15=romaldki user-16=nove user-17=boldover user-18=bakery user-19=crrtipdl user-20=sosevalu user-21=oubpgvbx user-22=tstardom user-23=what user-24=havantho user-25=sketchy user-26=cath user-27=nvihkvu user-28=stagingerris user-29=dancinggardener user-30=ladburyp user-31=kategilpin user-32=design user-33=asandcoc user-34=sibtoncc user-35=bwppodcast user-36=zebrapho user-37=steve user-38=fawcettd user-39=burydropin user-40=nsceres user-41=beauty user-42=darkstar user-43=eatspam user-44=dhyana user-45=nscdp user-46=putterfc user-47=leftie user-48=foods user-49=health2045
Sep  9 03:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=fortunaz user-51=lkpier user-52=firstre5 user-53=steakbridieme user-54=donnychicago user-55=philmcph user-56=ctedorgu user-57=isleofwi user-58=smrszyqg user-59=nomistakes user-60=hidden user-61=barbersh user-62=tigerlet user-63=cambria1 user-64=cathski user-65=ninejimm user-66=reliable user-67=cwsocial user-68=howardon user-69=pugwash user-70=paulmca1 user-71=hirefootballgame user-72=eugincou user-73=courseme user-74=ultbcrra user-75=seftvta user-76=jonhartl user-77=firstres user-78=coursemc user-79=opaiscyx user-80=clarkass user-81=firstrel user-82=costestimatorco user-83=firstred user-84=highlegh user-85=southlon user-86=gilpin user-87=milloyco user-88=elecleis user-89=hubmaster user-90=putterfi user-91=fetch user-92=carsinyo user-93=accooper user-94=ianrayne user-95=connectedshoppin user-96=thqkgnbz user-97=nstriton user-98=brighto1 user-99=vivienn1 user-100=firstre2 user-101=oneoarco user-102=battlere
Sep  9 03:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=newstoda user-105=belle user-106=ggaaorgu user-107=bemadonn user-108=skyfirec user-109=alexadmin user-110=innovat1 user-111=stuartge user-112=askhform user-113=nativene user-114=foundation user-115=booff user-116=markward user-117=vantagep user-118=connect9 user-119=athenare user-120=lbscrmod user-121=maflemin user-122=ulsukarm user-123=jarvisin user-124=spectrum user-125=hodgesonweb user-126=theblack user-127=agproduc user-128=still user-129=stephani user-130=leereyn1 user-131=brmrjxl user-132=lakesan1 user-133=strathar user-134=atestord user-135=sarafoundation user-136=wilsonsw user-137=megacards user-138=musorguk user-139=martsblo user-140=dickemery123 user-141=ptkxhsbt user-142=hhdugcor user-143=lbhyisi user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 03:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 03:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:52 nativespace-cdp sudo[3836561]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:52 nativespace-cdp sudo[3836565]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GE0ZJ8j4qNF5lErk.~
Sep  9 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:52 nativespace-cdp sudo[3836569]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GE0ZJ8j4qNF5lErk.~'
Sep  9 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:52 nativespace-cdp sudo[3836572]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GE0ZJ8j4qNF5lErk.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:52 nativespace-cdp sudo[3836576]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:52 nativespace-cdp sudo[3836579]: pam_unix(sudo:session): session closed for user root
Sep  9 03:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 03:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 03:09:53 nativespace-cdp sudo[3836596]: pam_unix(sudo:session): session closed for user root
Sep  9 03:11:33 nativespace-cdp sshd[3837297]: Connection closed by 159.100.136.21 port 60794 [preauth]
Sep  9 03:16:33 nativespace-cdp sshd[3838313]: Connection closed by 159.100.136.21 port 42018 [preauth]
Sep  9 03:26:33 nativespace-cdp sshd[3840615]: Connection closed by 159.100.136.21 port 59484 [preauth]
Sep  9 03:31:33 nativespace-cdp sshd[3841878]: Connection closed by 159.100.136.21 port 40280 [preauth]
Sep  9 03:36:34 nativespace-cdp sshd[3843424]: Connection closed by 159.100.136.21 port 49742 [preauth]
Sep  9 03:41:35 nativespace-cdp sshd[3844820]: Connection closed by 159.100.136.21 port 58944 [preauth]
Sep  9 03:46:36 nativespace-cdp sshd[3845775]: Connection closed by 159.100.136.21 port 40256 [preauth]
Sep  9 03:51:33 nativespace-cdp sshd[3846806]: Connection closed by 159.100.136.21 port 49790 [preauth]
Sep  9 03:56:33 nativespace-cdp sshd[3847906]: Connection closed by 159.100.136.21 port 59332 [preauth]
Sep  9 04:01:33 nativespace-cdp sshd[3849275]: Connection closed by 159.100.136.21 port 39860 [preauth]
Sep  9 04:06:33 nativespace-cdp sshd[3850245]: Connection closed by 159.100.136.21 port 49578 [preauth]
Sep  9 04:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 04:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:46 nativespace-cdp sudo[3851000]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 04:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:46 nativespace-cdp sudo[3851003]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 04:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:47 nativespace-cdp sudo[3851006]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 04:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:47 nativespace-cdp sudo[3851010]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 04:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:48 nativespace-cdp sudo[3851014]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:48 nativespace-cdp sudo[3851023]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:48 nativespace-cdp sudo[3851026]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:48 nativespace-cdp sudo[3851029]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:48 nativespace-cdp sudo[3851032]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:48 nativespace-cdp sudo[3851035]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:48 nativespace-cdp sudo[3851038]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 04:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:50 nativespace-cdp sudo[3851045]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 04:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:50 nativespace-cdp sudo[3851049]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nstriton user-2=brighto1 user-3=oneoarco user-4=battlere user-5=vivienn1 user-6=firstre2 user-7=bedfords user-8=bemadonn user-9=newstoda user-10=belle user-11=ggaaorgu user-12=alexadmin user-13=skyfirec user-14=askhform user-15=stuartge user-16=innovat1 user-17=nativene user-18=firstres user-19=ultbcrra user-20=seftvta user-21=jonhartl user-22=opaiscyx user-23=coursemc user-24=costestimatorco user-25=clarkass user-26=firstrel user-27=highlegh user-28=southlon user-29=firstred user-30=elecleis user-31=milloyco user-32=gilpin user-33=fetch user-34=carsinyo user-35=hubmaster user-36=putterfi user-37=ianrayne user-38=accooper user-39=thqkgnbz user-40=connectedshoppin user-41=brmrjxl user-42=lakesan1 user-43=atestord user-44=sarafoundation user-45=strathar user-46=wilsonsw user-47=megacards
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=musorguk user-49=martsblo user-50=ptkxhsbt user-51=dickemery123 user-52=hhdugcor user-53=lbhyisi user-54=magichat user-55=foundation user-56=booff user-57=markward user-58=lbscrmod user-59=maflemin user-60=vantagep user-61=athenare user-62=connect9 user-63=ulsukarm user-64=jarvisin user-65=theblack user-66=hodgesonweb user-67=spectrum user-68=agproduc user-69=still user-70=leereyn1 user-71=stephani user-72=nove user-73=boldover user-74=crrtipdl user-75=sosevalu user-76=bakery user-77=what user-78=oubpgvbx user-79=tstardom user-80=nvihkvu user-81=havantho user-82=cath user-83=sketchy user-84=kategilpin user-85=stagingerris user-86=dancinggardener user-87=ladburyp user-88=design user-89=tomandle user-90=jennimil user-91=mcdermos user-92=chrisdal user-93=david user-94=careers user-95=nbhavers user-96=lucy user-97=attlebor user-98=onlycont user-99=branko user-100=ranxterc user-101=hodgsonmail
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=outdoorc user-103=romaldki user-104=foods user-105=leftie user-106=health2045 user-107=fortunaz user-108=nscdp user-109=putterfc user-110=donnychicago user-111=firstre5 user-112=steakbridieme user-113=philmcph user-114=ctedorgu user-115=lkpier user-116=isleofwi user-117=smrszyqg user-118=barbersh user-119=tigerlet user-120=nomistakes user-121=hidden user-122=reliable user-123=ninejimm user-124=cathski user-125=cambria1 user-126=cwsocial user-127=paulmca1 user-128=howardon user-129=pugwash user-130=hirefootballgame user-131=courseme user-132=eugincou user-133=sibtoncc user-134=asandcoc user-135=zebrapho user-136=bwppodcast user-137=steve user-138=fawcettd user-139=burydropin user-140=nsceres user-141=darkstar user-142=eatspam user-143=beauty user-144=dhyana feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 04:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:50 nativespace-cdp sudo[3851054]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 04:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:50 nativespace-cdp sudo[3851059]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2WcxfXoe9wAIqhIW.~
Sep  9 04:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:50 nativespace-cdp sudo[3851062]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2WcxfXoe9wAIqhIW.~'
Sep  9 04:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:50 nativespace-cdp sudo[3851065]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2WcxfXoe9wAIqhIW.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 04:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:50 nativespace-cdp sudo[3851069]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 04:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:50 nativespace-cdp sudo[3851072]: pam_unix(sudo:session): session closed for user root
Sep  9 04:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 04:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:09:52 nativespace-cdp sudo[3851090]: pam_unix(sudo:session): session closed for user root
Sep  9 04:11:33 nativespace-cdp sshd[3851738]: Connection closed by 159.100.136.21 port 58780 [preauth]
Sep  9 04:16:33 nativespace-cdp sshd[3852739]: Connection closed by 159.100.136.21 port 35352 [preauth]
Sep  9 04:21:33 nativespace-cdp sshd[3853841]: Connection closed by 159.100.136.21 port 44920 [preauth]
Sep  9 04:26:34 nativespace-cdp sshd[3854856]: Connection closed by 159.100.136.21 port 53646 [preauth]
Sep  9 04:31:36 nativespace-cdp sshd[3856096]: Connection closed by 159.100.136.21 port 34634 [preauth]
Sep  9 04:36:33 nativespace-cdp sshd[3857794]: Connection closed by 159.100.136.21 port 42890 [preauth]
Sep  9 04:41:36 nativespace-cdp sshd[3859620]: Connection closed by 159.100.136.21 port 51556 [preauth]
Sep  9 04:46:34 nativespace-cdp sshd[3860690]: Connection closed by 159.100.136.21 port 60874 [preauth]
Sep  9 04:51:35 nativespace-cdp sshd[3861626]: Connection closed by 159.100.136.21 port 41350 [preauth]
Sep  9 04:56:35 nativespace-cdp sshd[3863274]: Connection closed by 159.100.136.21 port 50820 [preauth]
Sep  9 04:56:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 04:56:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:56:52 nativespace-cdp sudo[3863364]: pam_unix(sudo:session): session closed for user root
Sep  9 04:56:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 04:56:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:56:52 nativespace-cdp sudo[3863371]: pam_unix(sudo:session): session closed for user root
Sep  9 04:56:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 04:56:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:56:57 nativespace-cdp sudo[3863390]: pam_unix(sudo:session): session closed for user root
Sep  9 04:56:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=stephani user-2=leereyn1 user-3=agproduc user-4=still user-5=spectrum user-6=hodgesonweb user-7=theblack user-8=jarvisin user-9=ulsukarm user-10=vantagep user-11=athenare user-12=connect9 user-13=lbscrmod user-14=maflemin user-15=foundation user-16=markward user-17=booff user-18=magichat user-19=hhdugcor user-20=lbhyisi user-21=dickemery123 user-22=ptkxhsbt user-23=martsblo user-24=megacards user-25=musorguk user-26=wilsonsw user-27=strathar user-28=atestord user-29=sarafoundation user-30=brmrjxl user-31=lakesan1 user-32=connectedshoppin user-33=thqkgnbz user-34=accooper user-35=ianrayne user-36=hubmaster user-37=putterfi user-38=fetch user-39=carsinyo user-40=milloyco user-41=gilpin user-42=elecleis user-43=firstred user-44=highlegh user-45=southlon user-46=firstrel user-47=clarkass
Sep  9 04:56:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=costestimatorco user-49=opaiscyx user-50=coursemc user-51=ultbcrra user-52=jonhartl user-53=seftvta user-54=firstres user-55=nativene user-56=innovat1 user-57=askhform user-58=stuartge user-59=skyfirec user-60=alexadmin user-61=newstoda user-62=belle user-63=ggaaorgu user-64=bemadonn user-65=bedfords user-66=vivienn1 user-67=firstre2 user-68=oneoarco user-69=battlere user-70=nstriton user-71=brighto1 user-72=dhyana user-73=beauty user-74=darkstar user-75=eatspam user-76=nsceres user-77=fawcettd user-78=burydropin user-79=steve user-80=bwppodcast user-81=zebrapho user-82=asandcoc user-83=sibtoncc user-84=eugincou user-85=courseme user-86=hirefootballgame user-87=cwsocial user-88=pugwash user-89=howardon user-90=paulmca1 user-91=cathski user-92=cambria1 user-93=reliable user-94=ninejimm user-95=nomistakes user-96=hidden user-97=barbersh user-98=tigerlet user-99=isleofwi user-100=smrszyqg user-101=lkpier
Sep  9 04:56:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=firstre5 user-103=donnychicago user-104=steakbridieme user-105=ctedorgu user-106=philmcph user-107=nscdp user-108=putterfc user-109=leftie user-110=foods user-111=fortunaz user-112=health2045 user-113=romaldki user-114=outdoorc user-115=ranxterc user-116=hodgsonmail user-117=branko user-118=onlycont user-119=lucy user-120=attlebor user-121=david user-122=nbhavers user-123=careers user-124=chrisdal user-125=mcdermos user-126=jennimil user-127=tomandle user-128=design user-129=dancinggardener user-130=stagingerris user-131=ladburyp user-132=kategilpin user-133=havantho user-134=sketchy user-135=cath user-136=nvihkvu user-137=oubpgvbx user-138=tstardom user-139=what user-140=bakery user-141=crrtipdl user-142=sosevalu user-143=boldover user-144=nove feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 04:56:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 04:56:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:56:58 nativespace-cdp sudo[3863395]: pam_unix(sudo:session): session closed for user root
Sep  9 04:56:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  9 04:56:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:56:59 nativespace-cdp sudo[3863403]: pam_unix(sudo:session): session closed for user root
Sep  9 04:56:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep  9 04:56:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:56:59 nativespace-cdp sudo[3863407]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  9 04:57:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 04:57:27 nativespace-cdp sudo[3863554]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 04:57:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  9 04:57:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:57:28 nativespace-cdp sudo[3863561]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep  9 04:57:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:57:29 nativespace-cdp sudo[3863637]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep  9 04:57:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:57:31 nativespace-cdp sudo[3863644]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  9 04:57:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:57:31 nativespace-cdp sudo[3863653]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep  9 04:57:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:57:35 nativespace-cdp sudo[3863671]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep  9 04:57:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:57:39 nativespace-cdp sudo[3863682]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep  9 04:57:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:57:39 nativespace-cdp sudo[3863711]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep  9 04:57:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:57:40 nativespace-cdp sudo[3863715]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep  9 04:57:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:57:49 nativespace-cdp sudo[3863796]: pam_unix(sudo:session): session closed for user root
Sep  9 04:57:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  9 04:57:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 04:57:52 nativespace-cdp sudo[3863855]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 04:57:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  9 04:57:52 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  9 04:57:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  9 04:57:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 04:57:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 04:57:52 nativespace-cdp sudo[3863862]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 04:57:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  9 04:57:52 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  9 04:57:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  9 04:57:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 04:57:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 04:58:15 nativespace-cdp sudo[3863869]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 04:58:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  9 04:58:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 04:58:30 nativespace-cdp sudo[3864148]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 04:58:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  9 04:58:30 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  9 04:58:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  9 04:58:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 04:58:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 04:58:30 nativespace-cdp sudo[3864154]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 04:58:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep  9 04:58:30 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep  9 04:58:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep  9 04:58:30 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 04:58:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 04:58:30 nativespace-cdp sudo[3864160]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 04:58:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  9 04:58:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:58:33 nativespace-cdp sudo[3864197]: pam_unix(sudo:session): session closed for user root
Sep  9 04:58:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep  9 04:58:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:58:33 nativespace-cdp sudo[3864206]: pam_unix(sudo:session): session closed for user root
Sep  9 04:58:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  9 04:58:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 04:58:56 nativespace-cdp sudo[3864460]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 04:58:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep  9 04:58:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:58:57 nativespace-cdp sudo[3864466]: pam_unix(sudo:session): session closed for user root
Sep  9 04:58:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep  9 04:58:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:58:57 nativespace-cdp sudo[3864471]: pam_unix(sudo:session): session closed for user root
Sep  9 04:58:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  9 04:58:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:58:57 nativespace-cdp sudo[3864476]: pam_unix(sudo:session): session closed for user root
Sep  9 04:58:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep  9 04:58:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:58:59 nativespace-cdp sudo[3864489]: pam_unix(sudo:session): session closed for user root
Sep  9 04:58:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep  9 04:58:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:58:59 nativespace-cdp sudo[3864494]: pam_unix(sudo:session): session closed for user root
Sep  9 04:59:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep  9 04:59:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 04:59:31 nativespace-cdp sudo[3864661]: pam_unix(sudo:session): session closed for user root
Sep  9 04:59:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  9 04:59:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 04:59:34 nativespace-cdp sudo[3864715]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 04:59:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  9 04:59:34 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  9 04:59:34 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  9 04:59:34 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 04:59:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 04:59:34 nativespace-cdp sudo[3864721]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 04:59:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  9 04:59:34 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  9 04:59:34 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  9 04:59:34 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 04:59:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 04:59:51 nativespace-cdp sudo[3864731]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 04:59:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  9 04:59:51 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  9 04:59:51 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  9 04:59:51 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 04:59:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 04:59:53 nativespace-cdp sudo[3864783]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  9 05:00:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 05:00:00 nativespace-cdp sudo[3864943]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 05:00:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 05:00:00 nativespace-cdp sudo[3864954]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 05:00:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 05:00:00 nativespace-cdp sudo[3864964]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep  9 05:00:00 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 05:00:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 05:00:00 nativespace-cdp sudo[3864976]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 05:00:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  9 05:00:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:03 nativespace-cdp sudo[3865199]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep  9 05:00:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:04 nativespace-cdp sudo[3865207]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep  9 05:00:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:10 nativespace-cdp sudo[3865234]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep  9 05:00:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:10 nativespace-cdp sudo[3865239]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  9 05:00:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  9 05:00:10 nativespace-cdp sudo[3865251]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  9 05:00:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep  9 05:00:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:11 nativespace-cdp sudo[3865258]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep  9 05:00:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:11 nativespace-cdp sudo[3865263]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep  9 05:00:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:12 nativespace-cdp sudo[3865268]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  9 05:00:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:12 nativespace-cdp sudo[3865277]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  9 05:00:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 05:00:34 nativespace-cdp sudo[3865381]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 05:00:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep  9 05:00:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:35 nativespace-cdp sudo[3865389]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  9 05:00:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:35 nativespace-cdp sudo[3865394]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep  9 05:00:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:39 nativespace-cdp sudo[3865412]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep  9 05:00:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:00:44 nativespace-cdp sudo[3865483]: pam_unix(sudo:session): session closed for user root
Sep  9 05:00:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  9 05:00:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 05:00:47 nativespace-cdp sudo[3865540]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 05:00:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  9 05:00:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  9 05:00:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  9 05:00:47 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 05:00:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 05:00:48 nativespace-cdp sudo[3865546]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 05:00:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  9 05:00:48 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  9 05:00:48 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  9 05:00:48 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 05:00:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 05:01:06 nativespace-cdp sudo[3865553]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep  9 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 05:01:11 nativespace-cdp sudo[3865779]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  9 05:01:11 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  9 05:01:11 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  9 05:01:11 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 05:01:12 nativespace-cdp sudo[3865786]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep  9 05:01:12 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep  9 05:01:12 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep  9 05:01:12 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep  9 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 05:01:12 nativespace-cdp sudo[3865792]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  9 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:14 nativespace-cdp sudo[3865831]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep  9 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:14 nativespace-cdp sudo[3865835]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep  9 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  9 05:01:30 nativespace-cdp sudo[3865921]: pam_unix(sudo:session): session closed for user fortunaz
Sep  9 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep  9 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:30 nativespace-cdp sudo[3865929]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep  9 05:01:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:31 nativespace-cdp sudo[3865933]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep  9 05:01:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:31 nativespace-cdp sudo[3865941]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep  9 05:01:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:34 nativespace-cdp sudo[3865955]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep  9 05:01:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:34 nativespace-cdp sshd[3865960]: Connection closed by 159.100.136.21 port 59810 [preauth]
Sep  9 05:01:34 nativespace-cdp sudo[3865962]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep  9 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:39 nativespace-cdp sudo[3866030]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=leereyn1 WpToolkitNotification send_admin_auto_updates_notification available_updates_text= available_updates_list= installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep  9 05:01:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:49 nativespace-cdp sudo[3866215]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep  9 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:57 nativespace-cdp sudo[3866379]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  9 05:01:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866383]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866386]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866389]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866392]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866395]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866398]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866401]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866405]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866408]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866411]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866414]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866417]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866420]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866423]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:58 nativespace-cdp sudo[3866426]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866429]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866432]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866435]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866438]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866441]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866445]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866448]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866451]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866454]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866457]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866460]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866463]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866466]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866469]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866472]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866475]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866478]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866481]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866484]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866487]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866490]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866493]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866496]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866499]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866503]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866506]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866509]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866512]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866515]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866518]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866521]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:01:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:01:59 nativespace-cdp sudo[3866524]: pam_unix(sudo:session): session closed for user root
Sep  9 05:01:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866527]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866530]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866533]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866536]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866539]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866542]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866545]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866548]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866552]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866555]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866558]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866561]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866564]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866567]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866570]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866573]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866576]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866579]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866582]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866585]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866588]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866592]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866595]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866599]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866602]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866606]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866609]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866612]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866615]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866618]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866621]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866624]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:00 nativespace-cdp sudo[3866627]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866630]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866633]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866636]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866647]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866650]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866654]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866657]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866660]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866663]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866666]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866669]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866673]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866676]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866679]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866682]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866685]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866688]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866691]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866694]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866697]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866700]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866703]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866706]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866710]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866713]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866716]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866719]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866722]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866725]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866728]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866731]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:01 nativespace-cdp sudo[3866735]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866738]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866741]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866744]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866747]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866750]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866753]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866756]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866759]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866762]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866765]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866768]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866771]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866774]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866777]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866780]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866783]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866786]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866789]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866792]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866795]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866798]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866801]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866804]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866807]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866810]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866813]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866816]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866819]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866822]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866826]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866829]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866832]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866835]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866838]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866841]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866844]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866847]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866850]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep  9 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:02 nativespace-cdp sudo[3866853]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866856]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866859]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866862]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866865]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866868]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866871]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866874]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866877]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866880]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866883]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866886]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866889]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866892]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866895]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866898]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866901]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866904]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866907]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866910]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866913]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866916]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866919]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866922]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866925]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866928]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866931]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866935]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866939]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866942]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866945]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866948]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866951]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866954]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866957]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:03 nativespace-cdp sudo[3866962]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866966]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866969]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866972]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866975]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866979]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866982]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866985]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866988]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866991]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866994]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3866997]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867000]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867003]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867006]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867009]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867012]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867016]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867020]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867023]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867026]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867029]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867032]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867035]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867038]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867041]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867044]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867048]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867051]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867054]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867058]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867061]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867064]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867067]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867070]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867073]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867076]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:04 nativespace-cdp sudo[3867079]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  9 05:02:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:05 nativespace-cdp sudo[3867083]: pam_unix(sudo:session): session closed for user root
Sep  9 05:02:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep  9 05:02:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:02:05 nativespace-cdp sudo[3867087]: pam_unix(sudo:session): session closed for user root
Sep  9 05:06:33 nativespace-cdp sshd[3868179]: Connection closed by 159.100.136.21 port 39276 [preauth]
Sep  9 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:48 nativespace-cdp sudo[3868719]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:48 nativespace-cdp sudo[3868722]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:49 nativespace-cdp sudo[3868725]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:49 nativespace-cdp sudo[3868730]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:51 nativespace-cdp sudo[3868733]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 05:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:51 nativespace-cdp sudo[3868747]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 05:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:51 nativespace-cdp sudo[3868750]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 05:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:51 nativespace-cdp sudo[3868753]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 05:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:52 nativespace-cdp sudo[3868757]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 05:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:52 nativespace-cdp sudo[3868760]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 05:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:52 nativespace-cdp sudo[3868763]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:54 nativespace-cdp sudo[3868771]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:54 nativespace-cdp sudo[3868775]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=dickemery123 user-3=ptkxhsbt user-4=hhdugcor user-5=lbhyisi user-6=magichat user-7=brmrjxl user-8=lakesan1 user-9=strathar user-10=atestord user-11=sarafoundation user-12=wilsonsw user-13=megacards user-14=musorguk user-15=jarvisin user-16=spectrum user-17=theblack user-18=hodgesonweb user-19=agproduc user-20=still user-21=stephani user-22=leereyn1 user-23=foundation user-24=markward user-25=booff user-26=vantagep user-27=athenare user-28=connect9 user-29=lbscrmod user-30=maflemin user-31=ulsukarm user-32=alexadmin user-33=skyfirec user-34=innovat1 user-35=stuartge user-36=askhform user-37=nativene user-38=nstriton user-39=brighto1 user-40=vivienn1 user-41=firstre2 user-42=oneoarco user-43=battlere user-44=bedfords user-45=newstoda user-46=ggaaorgu user-47=belle user-48=bemadonn
Sep  9 05:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=milloyco user-50=gilpin user-51=elecleis user-52=hubmaster user-53=putterfi user-54=fetch user-55=carsinyo user-56=accooper user-57=ianrayne user-58=connectedshoppin user-59=thqkgnbz user-60=ultbcrra user-61=seftvta user-62=jonhartl user-63=firstres user-64=opaiscyx user-65=coursemc user-66=firstrel user-67=clarkass user-68=costestimatorco user-69=firstred user-70=highlegh user-71=southlon user-72=cathski user-73=cambria1 user-74=reliable user-75=ninejimm user-76=cwsocial user-77=howardon user-78=pugwash user-79=paulmca1 user-80=hirefootballgame user-81=eugincou user-82=courseme user-83=nscdp user-84=putterfc user-85=leftie user-86=foods user-87=health2045 user-88=fortunaz user-89=lkpier user-90=firstre5 user-91=donnychicago user-92=steakbridieme user-93=philmcph user-94=ctedorgu user-95=isleofwi user-96=smrszyqg user-97=nomistakes user-98=hidden user-99=tigerlet user-100=barbersh user-101=fawcettd
Sep  9 05:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=burydropin user-103=nsceres user-104=beauty user-105=darkstar user-106=eatspam user-107=dhyana user-108=sibtoncc user-109=asandcoc user-110=bwppodcast user-111=zebrapho user-112=steve user-113=tstardom user-114=oubpgvbx user-115=what user-116=havantho user-117=cath user-118=sketchy user-119=nvihkvu user-120=dancinggardener user-121=stagingerris user-122=ladburyp user-123=kategilpin user-124=design user-125=nove user-126=boldover user-127=bakery user-128=crrtipdl user-129=sosevalu user-130=lucy user-131=attlebor user-132=onlycont user-133=ranxterc user-134=outdoorc user-135=hodgsonmail user-136=branko user-137=romaldki user-138=tomandle user-139=jennimil user-140=chrisdal user-141=mcdermos user-142=david user-143=careers user-144=nbhavers feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 05:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:55 nativespace-cdp sudo[3868780]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 05:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:55 nativespace-cdp sudo[3868787]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-faJbeU09iZMy4JKr.~
Sep  9 05:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:55 nativespace-cdp sudo[3868790]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-faJbeU09iZMy4JKr.~'
Sep  9 05:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:55 nativespace-cdp sudo[3868793]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-faJbeU09iZMy4JKr.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 05:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:55 nativespace-cdp sudo[3868797]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 05:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:55 nativespace-cdp sudo[3868800]: pam_unix(sudo:session): session closed for user root
Sep  9 05:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 05:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 05:09:56 nativespace-cdp sudo[3868818]: pam_unix(sudo:session): session closed for user root
Sep  9 05:11:33 nativespace-cdp sshd[3869307]: Connection closed by 159.100.136.21 port 47032 [preauth]
Sep  9 05:16:35 nativespace-cdp sshd[3870271]: Connection closed by 159.100.136.21 port 56458 [preauth]
Sep  9 05:21:33 nativespace-cdp sshd[3871499]: Connection closed by 159.100.136.21 port 36862 [preauth]
Sep  9 05:26:33 nativespace-cdp sshd[3872486]: Connection closed by 159.100.136.21 port 45984 [preauth]
Sep  9 05:31:33 nativespace-cdp sshd[3873578]: Connection closed by 159.100.136.21 port 55326 [preauth]
Sep  9 05:35:08 nativespace-cdp su: pam_unix(su:session): session opened for user lkpier by (uid=0)
Sep  9 05:35:08 nativespace-cdp su[3874501]: pam_unix(su:session): session closed for user lkpier
Sep  9 05:36:35 nativespace-cdp sshd[3874844]: Connection closed by 159.100.136.21 port 35918 [preauth]
Sep  9 05:41:33 nativespace-cdp sshd[3875949]: Connection closed by 159.100.136.21 port 45234 [preauth]
Sep  9 05:46:33 nativespace-cdp sshd[3877229]: Connection closed by 159.100.136.21 port 54322 [preauth]
Sep  9 05:51:33 nativespace-cdp sshd[3878201]: Connection closed by 159.100.136.21 port 35634 [preauth]
Sep  9 05:56:33 nativespace-cdp sshd[3879301]: Connection closed by 159.100.136.21 port 45150 [preauth]
Sep  9 06:01:33 nativespace-cdp sshd[3880550]: Connection closed by 159.100.136.21 port 54108 [preauth]
Sep  9 06:06:35 nativespace-cdp sshd[3881536]: Connection closed by 159.100.136.21 port 35402 [preauth]
Sep  9 06:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 06:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:47 nativespace-cdp sudo[3882051]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 06:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:47 nativespace-cdp sudo[3882054]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 06:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:48 nativespace-cdp sudo[3882057]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 06:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:48 nativespace-cdp sudo[3882062]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 06:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:50 nativespace-cdp sudo[3882066]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:50 nativespace-cdp sudo[3882082]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:50 nativespace-cdp sudo[3882085]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:50 nativespace-cdp sudo[3882088]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:50 nativespace-cdp sudo[3882091]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:50 nativespace-cdp sudo[3882094]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:50 nativespace-cdp sudo[3882097]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:58 nativespace-cdp sudo[3882117]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 06:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:58 nativespace-cdp sudo[3882122]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=outdoorc user-2=ranxterc user-3=hodgsonmail user-4=branko user-5=romaldki user-6=attlebor user-7=lucy user-8=onlycont user-9=chrisdal user-10=mcdermos user-11=careers user-12=nbhavers user-13=david user-14=tomandle user-15=jennimil user-16=ladburyp user-17=dancinggardener user-18=stagingerris user-19=kategilpin user-20=design user-21=tstardom user-22=oubpgvbx user-23=what user-24=sketchy user-25=cath user-26=havantho user-27=nvihkvu user-28=bakery user-29=sosevalu user-30=crrtipdl user-31=nove user-32=boldover user-33=beauty user-34=eatspam user-35=darkstar user-36=dhyana user-37=burydropin user-38=fawcettd user-39=nsceres user-40=bwppodcast user-41=zebrapho user-42=steve user-43=sibtoncc user-44=asandcoc user-45=hirefootballgame user-46=eugincou user-47=courseme user-48=cathski user-49=cambria1
Sep  9 06:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=reliable user-51=ninejimm user-52=pugwash user-53=paulmca1 user-54=howardon user-55=cwsocial user-56=smrszyqg user-57=isleofwi user-58=hidden user-59=nomistakes user-60=barbersh user-61=tigerlet user-62=putterfc user-63=nscdp user-64=fortunaz user-65=health2045 user-66=leftie user-67=foods user-68=lkpier user-69=ctedorgu user-70=philmcph user-71=donnychicago user-72=steakbridieme user-73=firstre5 user-74=accooper user-75=ianrayne user-76=connectedshoppin user-77=thqkgnbz user-78=milloyco user-79=gilpin user-80=elecleis user-81=putterfi user-82=hubmaster user-83=carsinyo user-84=fetch user-85=firstrel user-86=clarkass user-87=costestimatorco user-88=firstred user-89=southlon user-90=highlegh user-91=jonhartl user-92=seftvta user-93=ultbcrra user-94=firstres user-95=opaiscyx user-96=coursemc user-97=innovat1 user-98=stuartge user-99=askhform user-100=nativene user-101=alexadmin user-102=skyfirec
Sep  9 06:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=ggaaorgu user-105=belle user-106=newstoda user-107=bemadonn user-108=brighto1 user-109=nstriton user-110=firstre2 user-111=vivienn1 user-112=battlere user-113=oneoarco user-114=still user-115=agproduc user-116=stephani user-117=leereyn1 user-118=jarvisin user-119=spectrum user-120=theblack user-121=hodgesonweb user-122=ulsukarm user-123=markward user-124=booff user-125=foundation user-126=connect9 user-127=athenare user-128=vantagep user-129=maflemin user-130=lbscrmod user-131=lbhyisi user-132=hhdugcor user-133=magichat user-134=martsblo user-135=dickemery123 user-136=ptkxhsbt user-137=wilsonsw user-138=musorguk user-139=megacards user-140=brmrjxl user-141=lakesan1 user-142=strathar user-143=sarafoundation user-144=atestord feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 06:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 06:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:59 nativespace-cdp sudo[3882127]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 06:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:59 nativespace-cdp sudo[3882133]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YylDTqQuBMrI8LWp.~
Sep  9 06:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:59 nativespace-cdp sudo[3882136]: pam_unix(sudo:session): session closed for user root
Sep  9 06:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YylDTqQuBMrI8LWp.~'
Sep  9 06:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:09:59 nativespace-cdp sudo[3882139]: pam_unix(sudo:session): session closed for user root
Sep  9 06:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YylDTqQuBMrI8LWp.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 06:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:10:00 nativespace-cdp sudo[3882143]: pam_unix(sudo:session): session closed for user root
Sep  9 06:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 06:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:10:00 nativespace-cdp sudo[3882146]: pam_unix(sudo:session): session closed for user root
Sep  9 06:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 06:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:10:06 nativespace-cdp sudo[3882287]: pam_unix(sudo:session): session closed for user root
Sep  9 06:11:33 nativespace-cdp sshd[3882975]: Connection closed by 159.100.136.21 port 44612 [preauth]
Sep  9 06:16:33 nativespace-cdp sshd[3884029]: Connection closed by 159.100.136.21 port 53612 [preauth]
Sep  9 06:21:33 nativespace-cdp sshd[3885040]: Connection closed by 159.100.136.21 port 33872 [preauth]
Sep  9 06:26:33 nativespace-cdp sshd[3885960]: Connection closed by 159.100.136.21 port 42594 [preauth]
Sep  9 06:31:34 nativespace-cdp sshd[3887319]: Connection closed by 159.100.136.21 port 51414 [preauth]
Sep  9 06:36:33 nativespace-cdp sshd[3888324]: Connection closed by 159.100.136.21 port 60872 [preauth]
Sep  9 06:39:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 06:39:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 06:39:02 nativespace-cdp sudo[3888712]: pam_unix(sudo:session): session closed for user root
Sep  9 06:41:36 nativespace-cdp sshd[3889655]: Connection closed by 159.100.136.21 port 41646 [preauth]
Sep  9 06:46:33 nativespace-cdp sshd[3890753]: Connection closed by 159.100.136.21 port 50822 [preauth]
Sep  9 06:51:33 nativespace-cdp sshd[3891738]: Connection closed by 159.100.136.21 port 60044 [preauth]
Sep  9 06:56:33 nativespace-cdp sshd[3892809]: Connection closed by 159.100.136.21 port 40510 [preauth]
Sep  9 07:01:33 nativespace-cdp sshd[3894169]: Connection closed by 159.100.136.21 port 49000 [preauth]
Sep  9 07:06:33 nativespace-cdp sshd[3895145]: Connection closed by 159.100.136.21 port 58796 [preauth]
Sep  9 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:47 nativespace-cdp sudo[3895658]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:47 nativespace-cdp sudo[3895663]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:47 nativespace-cdp sudo[3895668]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:47 nativespace-cdp sudo[3895674]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:49 nativespace-cdp sudo[3895680]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:49 nativespace-cdp sudo[3895690]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:49 nativespace-cdp sudo[3895694]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:49 nativespace-cdp sudo[3895700]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:49 nativespace-cdp sudo[3895706]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:49 nativespace-cdp sudo[3895711]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:49 nativespace-cdp sudo[3895717]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:51 nativespace-cdp sudo[3895727]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:51 nativespace-cdp sudo[3895734]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=kategilpin user-2=dancinggardener user-3=stagingerris user-4=ladburyp user-5=design user-6=what user-7=tstardom user-8=oubpgvbx user-9=nvihkvu user-10=havantho user-11=sketchy user-12=cath user-13=crrtipdl user-14=sosevalu user-15=bakery user-16=nove user-17=boldover user-18=branko user-19=ranxterc user-20=outdoorc user-21=hodgsonmail user-22=romaldki user-23=lucy user-24=attlebor user-25=onlycont user-26=mcdermos user-27=chrisdal user-28=david user-29=nbhavers user-30=careers user-31=tomandle user-32=jennimil user-33=hirefootballgame user-34=courseme user-35=eugincou user-36=reliable user-37=ninejimm user-38=cambria1 user-39=cathski user-40=cwsocial user-41=pugwash user-42=paulmca1 user-43=howardon user-44=smrszyqg user-45=isleofwi user-46=tigerlet user-47=barbersh user-48=nomistakes
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=hidden user-50=leftie user-51=foods user-52=health2045 user-53=fortunaz user-54=nscdp user-55=putterfc user-56=firstre5 user-57=steakbridieme user-58=donnychicago user-59=ctedorgu user-60=philmcph user-61=lkpier user-62=darkstar user-63=eatspam user-64=beauty user-65=dhyana user-66=fawcettd user-67=burydropin user-68=nsceres user-69=zebrapho user-70=bwppodcast user-71=steve user-72=asandcoc user-73=sibtoncc user-74=askhform user-75=stuartge user-76=innovat1 user-77=nativene user-78=skyfirec user-79=alexadmin user-80=bedfords user-81=bemadonn user-82=newstoda user-83=belle user-84=ggaaorgu user-85=nstriton user-86=brighto1 user-87=oneoarco user-88=battlere user-89=vivienn1 user-90=firstre2 user-91=ianrayne user-92=accooper user-93=thqkgnbz user-94=connectedshoppin user-95=elecleis user-96=gilpin user-97=milloyco user-98=fetch user-99=carsinyo user-100=hubmaster user-101=putterfi user-102=costestimatorco
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=firstrel user-104=clarkass user-105=highlegh user-106=southlon user-107=firstred user-108=firstres user-109=ultbcrra user-110=seftvta user-111=jonhartl user-112=coursemc user-113=opaiscyx user-114=hhdugcor user-115=lbhyisi user-116=magichat user-117=martsblo user-118=ptkxhsbt user-119=dickemery123 user-120=wilsonsw user-121=megacards user-122=musorguk user-123=brmrjxl user-124=lakesan1 user-125=atestord user-126=sarafoundation user-127=strathar user-128=agproduc user-129=still user-130=leereyn1 user-131=stephani user-132=jarvisin user-133=theblack user-134=hodgesonweb user-135=spectrum user-136=ulsukarm user-137=markward user-138=foundation user-139=booff user-140=lbscrmod user-141=maflemin user-142=vantagep user-143=connect9 user-144=athenare feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:51 nativespace-cdp sudo[3895740]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:51 nativespace-cdp sudo[3895747]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ggb0lGaf0h3tHizu.~
Sep  9 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:51 nativespace-cdp sudo[3895752]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ggb0lGaf0h3tHizu.~'
Sep  9 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:51 nativespace-cdp sudo[3895756]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ggb0lGaf0h3tHizu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 07:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:52 nativespace-cdp sudo[3895762]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 07:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:52 nativespace-cdp sudo[3895767]: pam_unix(sudo:session): session closed for user root
Sep  9 07:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 07:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 07:09:53 nativespace-cdp sudo[3895791]: pam_unix(sudo:session): session closed for user root
Sep  9 07:11:33 nativespace-cdp sshd[3896331]: Connection closed by 159.100.136.21 port 39808 [preauth]
Sep  9 07:16:33 nativespace-cdp sshd[3897646]: Connection closed by 159.100.136.21 port 49266 [preauth]
Sep  9 07:21:34 nativespace-cdp sshd[3898576]: Connection closed by 159.100.136.21 port 58622 [preauth]
Sep  9 07:26:36 nativespace-cdp sshd[3899951]: Connection closed by 159.100.136.21 port 39486 [preauth]
Sep  9 07:31:33 nativespace-cdp sshd[3901135]: Connection closed by 159.100.136.21 port 49152 [preauth]
Sep  9 07:41:36 nativespace-cdp sshd[3903273]: Connection closed by 159.100.136.21 port 38848 [preauth]
Sep  9 07:46:36 nativespace-cdp sshd[3904515]: Connection closed by 159.100.136.21 port 48330 [preauth]
Sep  9 07:51:34 nativespace-cdp sshd[3905489]: Connection closed by 159.100.136.21 port 57080 [preauth]
Sep  9 07:56:33 nativespace-cdp sshd[3906856]: Connection closed by 159.100.136.21 port 38504 [preauth]
Sep  9 08:01:33 nativespace-cdp sshd[3908051]: Connection closed by 159.100.136.21 port 47912 [preauth]
Sep  9 08:06:33 nativespace-cdp sshd[3909206]: Connection closed by 159.100.136.21 port 56632 [preauth]
Sep  9 08:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 08:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:49 nativespace-cdp sudo[3909718]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 08:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:49 nativespace-cdp sudo[3909723]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 08:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:51 nativespace-cdp sudo[3909728]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 08:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:51 nativespace-cdp sudo[3909734]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 08:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:54 nativespace-cdp sudo[3909740]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 08:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:54 nativespace-cdp sudo[3909755]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 08:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:54 nativespace-cdp sudo[3909760]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 08:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:54 nativespace-cdp sudo[3909764]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 08:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:54 nativespace-cdp sudo[3909769]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 08:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:54 nativespace-cdp sudo[3909774]: pam_unix(sudo:session): session closed for user root
Sep  9 08:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 08:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:09:54 nativespace-cdp sudo[3909780]: pam_unix(sudo:session): session closed for user root
Sep  9 08:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 08:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:10:05 nativespace-cdp sudo[3909970]: pam_unix(sudo:session): session closed for user root
Sep  9 08:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 08:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:10:05 nativespace-cdp sudo[3909977]: pam_unix(sudo:session): session closed for user root
Sep  9 08:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ninejimm user-2=reliable user-3=cathski user-4=cambria1 user-5=cwsocial user-6=pugwash user-7=paulmca1 user-8=howardon user-9=hirefootballgame user-10=courseme user-11=eugincou user-12=foods user-13=leftie user-14=health2045 user-15=fortunaz user-16=nscdp user-17=putterfc user-18=donnychicago user-19=steakbridieme user-20=firstre5 user-21=philmcph user-22=ctedorgu user-23=lkpier user-24=isleofwi user-25=smrszyqg user-26=tigerlet user-27=barbersh user-28=nomistakes user-29=hidden user-30=fawcettd user-31=burydropin user-32=nsceres user-33=darkstar user-34=eatspam user-35=beauty user-36=dhyana user-37=asandcoc user-38=sibtoncc user-39=zebrapho user-40=bwppodcast user-41=steve user-42=what user-43=oubpgvbx user-44=tstardom user-45=nvihkvu user-46=havantho user-47=cath user-48=sketchy
Sep  9 08:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=kategilpin user-50=dancinggardener user-51=stagingerris user-52=ladburyp user-53=design user-54=nove user-55=boldover user-56=crrtipdl user-57=sosevalu user-58=bakery user-59=lucy user-60=attlebor user-61=onlycont user-62=branko user-63=outdoorc user-64=ranxterc user-65=hodgsonmail user-66=romaldki user-67=tomandle user-68=jennimil user-69=mcdermos user-70=chrisdal user-71=david user-72=careers user-73=nbhavers user-74=martsblo user-75=ptkxhsbt user-76=dickemery123 user-77=hhdugcor user-78=lbhyisi user-79=magichat user-80=brmrjxl user-81=lakesan1 user-82=atestord user-83=sarafoundation user-84=strathar user-85=wilsonsw user-86=megacards user-87=musorguk user-88=jarvisin user-89=hodgesonweb user-90=theblack user-91=spectrum user-92=agproduc user-93=still user-94=leereyn1 user-95=stephani user-96=markward user-97=booff user-98=foundation user-99=lbscrmod user-100=maflemin user-101=vantagep user-102=connect9
Sep  9 08:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=athenare user-104=ulsukarm user-105=alexadmin user-106=skyfirec user-107=stuartge user-108=askhform user-109=innovat1 user-110=nativene user-111=nstriton user-112=brighto1 user-113=oneoarco user-114=battlere user-115=vivienn1 user-116=firstre2 user-117=bedfords user-118=bemadonn user-119=newstoda user-120=ggaaorgu user-121=belle user-122=elecleis user-123=milloyco user-124=gilpin user-125=fetch user-126=carsinyo user-127=putterfi user-128=hubmaster user-129=ianrayne user-130=accooper user-131=thqkgnbz user-132=connectedshoppin user-133=firstres user-134=ultbcrra user-135=jonhartl user-136=seftvta user-137=opaiscyx user-138=coursemc user-139=costestimatorco user-140=clarkass user-141=firstrel user-142=highlegh user-143=southlon user-144=firstred feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 08:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 08:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:10:07 nativespace-cdp sudo[3909984]: pam_unix(sudo:session): session closed for user root
Sep  9 08:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 08:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:10:08 nativespace-cdp sudo[3909994]: pam_unix(sudo:session): session closed for user root
Sep  9 08:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yHPKeVFcliW2RIY6.~
Sep  9 08:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:10:08 nativespace-cdp sudo[3910000]: pam_unix(sudo:session): session closed for user root
Sep  9 08:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yHPKeVFcliW2RIY6.~'
Sep  9 08:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:10:08 nativespace-cdp sudo[3910004]: pam_unix(sudo:session): session closed for user root
Sep  9 08:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-yHPKeVFcliW2RIY6.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 08:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:10:08 nativespace-cdp sudo[3910010]: pam_unix(sudo:session): session closed for user root
Sep  9 08:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 08:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:10:08 nativespace-cdp sudo[3910015]: pam_unix(sudo:session): session closed for user root
Sep  9 08:10:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 08:10:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 08:10:29 nativespace-cdp sudo[3910072]: pam_unix(sudo:session): session closed for user root
Sep  9 08:11:33 nativespace-cdp sshd[3910434]: Connection closed by 159.100.136.21 port 37806 [preauth]
Sep  9 08:16:33 nativespace-cdp sshd[3911714]: Connection closed by 159.100.136.21 port 46864 [preauth]
Sep  9 08:21:33 nativespace-cdp sshd[3912915]: Connection closed by 159.100.136.21 port 56246 [preauth]
Sep  9 08:26:34 nativespace-cdp sshd[3914300]: Connection closed by 159.100.136.21 port 37692 [preauth]
Sep  9 08:31:36 nativespace-cdp sshd[3915483]: Connection closed by 159.100.136.21 port 45972 [preauth]
Sep  9 08:33:06 nativespace-cdp sshd[3915731]: Invalid user cassandra from 218.150.246.42 port 58648
Sep  9 08:33:06 nativespace-cdp sshd[3915731]: input_userauth_request: invalid user cassandra [preauth]
Sep  9 08:33:06 nativespace-cdp sshd[3915731]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 08:33:06 nativespace-cdp sshd[3915731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.150.246.42
Sep  9 08:33:08 nativespace-cdp sshd[3915731]: Failed password for invalid user cassandra from 218.150.246.42 port 58648 ssh2
Sep  9 08:33:08 nativespace-cdp sshd[3915731]: Received disconnect from 218.150.246.42 port 58648:11: Bye Bye [preauth]
Sep  9 08:33:08 nativespace-cdp sshd[3915731]: Disconnected from 218.150.246.42 port 58648 [preauth]
Sep  9 08:35:19 nativespace-cdp sshd[3916283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.40.112.6  user=root
Sep  9 08:35:19 nativespace-cdp sshd[3916283]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 08:35:21 nativespace-cdp sshd[3916283]: Failed password for root from 179.40.112.6 port 44208 ssh2
Sep  9 08:35:25 nativespace-cdp sshd[3916283]: Received disconnect from 179.40.112.6 port 44208:11: Bye Bye [preauth]
Sep  9 08:35:25 nativespace-cdp sshd[3916283]: Disconnected from 179.40.112.6 port 44208 [preauth]
Sep  9 08:36:34 nativespace-cdp sshd[3916657]: Connection closed by 159.100.136.21 port 54250 [preauth]
Sep  9 08:39:55 nativespace-cdp sshd[3917365]: Invalid user virtual from 179.40.112.6 port 53784
Sep  9 08:39:55 nativespace-cdp sshd[3917365]: input_userauth_request: invalid user virtual [preauth]
Sep  9 08:39:55 nativespace-cdp sshd[3917365]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 08:39:55 nativespace-cdp sshd[3917365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.40.112.6
Sep  9 08:39:57 nativespace-cdp sshd[3917365]: Failed password for invalid user virtual from 179.40.112.6 port 53784 ssh2
Sep  9 08:39:57 nativespace-cdp sshd[3917365]: Received disconnect from 179.40.112.6 port 53784:11: Bye Bye [preauth]
Sep  9 08:39:57 nativespace-cdp sshd[3917365]: Disconnected from 179.40.112.6 port 53784 [preauth]
Sep  9 08:40:50 nativespace-cdp sshd[3917676]: Invalid user user22 from 179.40.112.6 port 40540
Sep  9 08:40:50 nativespace-cdp sshd[3917676]: input_userauth_request: invalid user user22 [preauth]
Sep  9 08:40:50 nativespace-cdp sshd[3917676]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 08:40:50 nativespace-cdp sshd[3917676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.40.112.6
Sep  9 08:40:52 nativespace-cdp sshd[3917676]: Failed password for invalid user user22 from 179.40.112.6 port 40540 ssh2
Sep  9 08:40:52 nativespace-cdp sshd[3917676]: Received disconnect from 179.40.112.6 port 40540:11: Bye Bye [preauth]
Sep  9 08:40:52 nativespace-cdp sshd[3917676]: Disconnected from 179.40.112.6 port 40540 [preauth]
Sep  9 08:41:36 nativespace-cdp sshd[3918259]: Connection closed by 159.100.136.21 port 34946 [preauth]
Sep  9 08:41:36 nativespace-cdp sshd[3918252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.93.7.194  user=root
Sep  9 08:41:36 nativespace-cdp sshd[3918252]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 08:41:39 nativespace-cdp sshd[3918252]: Failed password for root from 182.93.7.194 port 53424 ssh2
Sep  9 08:41:44 nativespace-cdp sshd[3918252]: Received disconnect from 182.93.7.194 port 53424:11: Bye Bye [preauth]
Sep  9 08:41:44 nativespace-cdp sshd[3918252]: Disconnected from 182.93.7.194 port 53424 [preauth]
Sep  9 08:46:02 nativespace-cdp sshd[3919426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.150.246.42  user=root
Sep  9 08:46:02 nativespace-cdp sshd[3919426]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 08:46:04 nativespace-cdp sshd[3919426]: Failed password for root from 218.150.246.42 port 41806 ssh2
Sep  9 08:46:04 nativespace-cdp sshd[3919426]: Received disconnect from 218.150.246.42 port 41806:11: Bye Bye [preauth]
Sep  9 08:46:04 nativespace-cdp sshd[3919426]: Disconnected from 218.150.246.42 port 41806 [preauth]
Sep  9 08:46:34 nativespace-cdp sshd[3919642]: Connection closed by 159.100.136.21 port 44526 [preauth]
Sep  9 08:46:45 nativespace-cdp sshd[3919680]: Connection closed by 182.93.7.194 port 62718 [preauth]
Sep  9 08:47:14 nativespace-cdp sshd[3919777]: Invalid user virtual from 218.150.246.42 port 52354
Sep  9 08:47:14 nativespace-cdp sshd[3919777]: input_userauth_request: invalid user virtual [preauth]
Sep  9 08:47:14 nativespace-cdp sshd[3919777]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 08:47:14 nativespace-cdp sshd[3919777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.150.246.42
Sep  9 08:47:16 nativespace-cdp sshd[3919777]: Failed password for invalid user virtual from 218.150.246.42 port 52354 ssh2
Sep  9 08:47:56 nativespace-cdp sshd[3919933]: Invalid user peertube from 182.93.7.194 port 44812
Sep  9 08:47:56 nativespace-cdp sshd[3919933]: input_userauth_request: invalid user peertube [preauth]
Sep  9 08:47:56 nativespace-cdp sshd[3919933]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 08:47:56 nativespace-cdp sshd[3919933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.93.7.194
Sep  9 08:47:58 nativespace-cdp sshd[3919933]: Failed password for invalid user peertube from 182.93.7.194 port 44812 ssh2
Sep  9 08:47:58 nativespace-cdp sshd[3919933]: Received disconnect from 182.93.7.194 port 44812:11: Bye Bye [preauth]
Sep  9 08:47:58 nativespace-cdp sshd[3919933]: Disconnected from 182.93.7.194 port 44812 [preauth]
Sep  9 08:49:14 nativespace-cdp sshd[3920148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.93.7.194  user=root
Sep  9 08:49:14 nativespace-cdp sshd[3920148]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 08:49:16 nativespace-cdp sshd[3920148]: Failed password for root from 182.93.7.194 port 57124 ssh2
Sep  9 08:51:33 nativespace-cdp sshd[3920850]: Connection closed by 159.100.136.21 port 53776 [preauth]
Sep  9 08:56:36 nativespace-cdp sshd[3922005]: Connection closed by 159.100.136.21 port 35538 [preauth]
Sep  9 09:01:33 nativespace-cdp sshd[3923619]: Connection closed by 159.100.136.21 port 44752 [preauth]
Sep  9 09:02:37 nativespace-cdp sshd[3923857]: Bad protocol version identification '\003' from 194.165.16.76 port 65352
Sep  9 09:06:36 nativespace-cdp sshd[3924754]: Connection closed by 159.100.136.21 port 53780 [preauth]
Sep  9 09:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 09:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:54 nativespace-cdp sudo[3925452]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 09:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:54 nativespace-cdp sudo[3925457]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 09:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:56 nativespace-cdp sudo[3925462]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:56 nativespace-cdp sudo[3925471]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 09:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:59 nativespace-cdp sudo[3925477]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 09:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:59 nativespace-cdp sudo[3925489]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 09:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:59 nativespace-cdp sudo[3925494]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 09:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:59 nativespace-cdp sudo[3925498]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 09:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:59 nativespace-cdp sudo[3925503]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 09:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:59 nativespace-cdp sudo[3925509]: pam_unix(sudo:session): session closed for user root
Sep  9 09:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 09:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:09:59 nativespace-cdp sudo[3925514]: pam_unix(sudo:session): session closed for user root
Sep  9 09:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 09:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:10:02 nativespace-cdp sudo[3925615]: pam_unix(sudo:session): session closed for user root
Sep  9 09:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 09:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:10:02 nativespace-cdp sudo[3925633]: pam_unix(sudo:session): session closed for user root
Sep  9 09:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=southlon user-2=highlegh user-3=firstred user-4=costestimatorco user-5=clarkass user-6=firstrel user-7=coursemc user-8=opaiscyx user-9=firstres user-10=jonhartl user-11=seftvta user-12=ultbcrra user-13=thqkgnbz user-14=connectedshoppin user-15=ianrayne user-16=accooper user-17=carsinyo user-18=fetch user-19=putterfi user-20=hubmaster user-21=elecleis user-22=gilpin user-23=milloyco user-24=bemadonn user-25=belle user-26=ggaaorgu user-27=newstoda user-28=bedfords user-29=battlere user-30=oneoarco user-31=firstre2 user-32=vivienn1 user-33=brighto1 user-34=nstriton user-35=nativene user-36=askhform user-37=stuartge user-38=innovat1 user-39=skyfirec user-40=alexadmin user-41=ulsukarm user-42=maflemin user-43=lbscrmod user-44=athenare user-45=connect9 user-46=vantagep user-47=foundation
Sep  9 09:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=markward user-49=booff user-50=leereyn1 user-51=stephani user-52=still user-53=agproduc user-54=hodgesonweb user-55=theblack user-56=spectrum user-57=jarvisin user-58=musorguk user-59=megacards user-60=wilsonsw user-61=sarafoundation user-62=atestord user-63=strathar user-64=brmrjxl user-65=lakesan1 user-66=magichat user-67=lbhyisi user-68=hhdugcor user-69=ptkxhsbt user-70=dickemery123 user-71=martsblo user-72=nbhavers user-73=careers user-74=david user-75=mcdermos user-76=chrisdal user-77=jennimil user-78=tomandle user-79=romaldki user-80=branko user-81=outdoorc user-82=ranxterc user-83=hodgsonmail user-84=onlycont user-85=attlebor user-86=lucy user-87=sosevalu user-88=crrtipdl user-89=bakery user-90=boldover user-91=nove user-92=design user-93=kategilpin user-94=ladburyp user-95=stagingerris user-96=dancinggardener user-97=nvihkvu user-98=sketchy user-99=cath user-100=havantho user-101=what
Sep  9 09:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=oubpgvbx user-103=tstardom user-104=steve user-105=zebrapho user-106=bwppodcast user-107=sibtoncc user-108=asandcoc user-109=dhyana user-110=eatspam user-111=darkstar user-112=beauty user-113=nsceres user-114=burydropin user-115=fawcettd user-116=barbersh user-117=tigerlet user-118=hidden user-119=nomistakes user-120=isleofwi user-121=smrszyqg user-122=ctedorgu user-123=philmcph user-124=steakbridieme user-125=firstre5 user-126=donnychicago user-127=lkpier user-128=health2045 user-129=fortunaz user-130=leftie user-131=foods user-132=putterfc user-133=nscdp user-134=courseme user-135=eugincou user-136=hirefootballgame user-137=howardon user-138=paulmca1 user-139=pugwash user-140=cwsocial user-141=reliable user-142=ninejimm user-143=cathski user-144=cambria1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  9 09:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 09:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:10:03 nativespace-cdp sudo[3925643]: pam_unix(sudo:session): session closed for user root
Sep  9 09:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 09:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:10:04 nativespace-cdp sudo[3925655]: pam_unix(sudo:session): session closed for user root
Sep  9 09:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dBCsmXdFaG2kXUvc.~
Sep  9 09:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:10:04 nativespace-cdp sudo[3925658]: pam_unix(sudo:session): session closed for user root
Sep  9 09:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dBCsmXdFaG2kXUvc.~'
Sep  9 09:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:10:04 nativespace-cdp sudo[3925661]: pam_unix(sudo:session): session closed for user root
Sep  9 09:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dBCsmXdFaG2kXUvc.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 09:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:10:04 nativespace-cdp sudo[3925666]: pam_unix(sudo:session): session closed for user root
Sep  9 09:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 09:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:10:04 nativespace-cdp sudo[3925669]: pam_unix(sudo:session): session closed for user root
Sep  9 09:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 09:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 09:10:16 nativespace-cdp sudo[3925713]: pam_unix(sudo:session): session closed for user root
Sep  9 09:11:33 nativespace-cdp sshd[3926393]: Connection closed by 159.100.136.21 port 33998 [preauth]
Sep  9 09:16:33 nativespace-cdp sshd[3927613]: Connection closed by 159.100.136.21 port 42706 [preauth]
Sep  9 09:21:33 nativespace-cdp sshd[3928691]: Connection closed by 159.100.136.21 port 51108 [preauth]
Sep  9 09:26:33 nativespace-cdp sshd[3930813]: Connection closed by 159.100.136.21 port 59974 [preauth]
Sep  9 09:31:33 nativespace-cdp sshd[3932096]: Connection closed by 159.100.136.21 port 41084 [preauth]
Sep  9 09:36:33 nativespace-cdp sshd[3933386]: Connection closed by 159.100.136.21 port 50862 [preauth]
Sep  9 09:41:33 nativespace-cdp sshd[3934746]: Connection closed by 159.100.136.21 port 59666 [preauth]
Sep  9 09:46:33 nativespace-cdp sshd[3936401]: Connection closed by 159.100.136.21 port 40172 [preauth]
Sep  9 09:51:33 nativespace-cdp sshd[3937530]: Connection closed by 159.100.136.21 port 48100 [preauth]
Sep  9 09:56:34 nativespace-cdp sshd[3938772]: Connection closed by 159.100.136.21 port 58074 [preauth]
Sep  9 10:01:33 nativespace-cdp sshd[3940452]: Connection closed by 159.100.136.21 port 39220 [preauth]
Sep  9 10:06:33 nativespace-cdp sshd[3941704]: Connection closed by 159.100.136.21 port 48570 [preauth]
Sep  9 10:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 10:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:50 nativespace-cdp sudo[3942494]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 10:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:50 nativespace-cdp sudo[3942499]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 10:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:51 nativespace-cdp sudo[3942504]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 10:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:51 nativespace-cdp sudo[3942509]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 10:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:53 nativespace-cdp sudo[3942516]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 10:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:53 nativespace-cdp sudo[3942528]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 10:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:53 nativespace-cdp sudo[3942533]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 10:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:53 nativespace-cdp sudo[3942537]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 10:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:53 nativespace-cdp sudo[3942543]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 10:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:53 nativespace-cdp sudo[3942549]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 10:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:53 nativespace-cdp sudo[3942554]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 10:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:57 nativespace-cdp sudo[3942577]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 10:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:57 nativespace-cdp sudo[3942584]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=foundation user-3=markward user-4=booff user-5=maflemin user-6=lbscrmod user-7=athenare user-8=connect9 user-9=vantagep user-10=still user-11=agproduc user-12=leereyn1 user-13=stephani user-14=jarvisin user-15=hodgesonweb user-16=theblack user-17=spectrum user-18=wilsonsw user-19=musorguk user-20=megacards user-21=lakesan1 user-22=brmrjxl user-23=sarafoundation user-24=atestord user-25=strathar user-26=lbhyisi user-27=hhdugcor user-28=magichat user-29=martsblo user-30=ptkxhsbt user-31=dickemery123 user-32=costestimatorco user-33=firstrel user-34=clarkass user-35=southlon user-36=highlegh user-37=firstred user-38=firstres user-39=jonhartl user-40=seftvta user-41=ultbcrra user-42=coursemc user-43=opaiscyx user-44=ianrayne user-45=accooper user-46=thqkgnbz user-47=connectedshoppin
Sep  9 10:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=elecleis user-49=gilpin user-50=milloyco user-51=carsinyo user-52=fetch user-53=hubmaster user-54=putterfi user-55=bedfords user-56=bemadonn user-57=belle user-58=ggaaorgu user-59=newstoda user-60=brighto1 user-61=nstriton user-62=battlere user-63=oneoarco user-64=firstre2 user-65=vivienn1 user-66=stuartge user-67=askhform user-68=innovat1 user-69=nativene user-70=skyfirec user-71=alexadmin user-72=zebrapho user-73=bwppodcast user-74=steve user-75=asandcoc user-76=sibtoncc user-77=eatspam user-78=darkstar user-79=beauty user-80=dhyana user-81=burydropin user-82=fawcettd user-83=nsceres user-84=isleofwi user-85=smrszyqg user-86=barbersh user-87=tigerlet user-88=hidden user-89=nomistakes user-90=fortunaz user-91=health2045 user-92=leftie user-93=foods user-94=putterfc user-95=nscdp user-96=ctedorgu user-97=philmcph user-98=firstre5 user-99=steakbridieme user-100=donnychicago user-101=lkpier
Sep  9 10:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hirefootballgame user-103=courseme user-104=eugincou user-105=ninejimm user-106=reliable user-107=cambria1 user-108=cathski user-109=paulmca1 user-110=howardon user-111=pugwash user-112=cwsocial user-113=mcdermos user-114=chrisdal user-115=careers user-116=nbhavers user-117=david user-118=tomandle user-119=jennimil user-120=branko user-121=outdoorc user-122=ranxterc user-123=hodgsonmail user-124=romaldki user-125=attlebor user-126=lucy user-127=onlycont user-128=sosevalu user-129=crrtipdl user-130=bakery user-131=nove user-132=boldover user-133=kategilpin user-134=ladburyp user-135=stagingerris user-136=dancinggardener user-137=design user-138=what user-139=tstardom user-140=oubpgvbx user-141=nvihkvu user-142=cath user-143=sketchy user-144=havantho feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 10:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 10:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:58 nativespace-cdp sudo[3942590]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:59 nativespace-cdp sudo[3942601]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4FYug8Gr6pHjTGPH.~
Sep  9 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:59 nativespace-cdp sudo[3942606]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4FYug8Gr6pHjTGPH.~'
Sep  9 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:59 nativespace-cdp sudo[3942611]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4FYug8Gr6pHjTGPH.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:59 nativespace-cdp sudo[3942617]: pam_unix(sudo:session): session closed for user root
Sep  9 10:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 10:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:09:59 nativespace-cdp sudo[3942622]: pam_unix(sudo:session): session closed for user root
Sep  9 10:10:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 10:10:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 10:10:33 nativespace-cdp sudo[3942851]: pam_unix(sudo:session): session closed for user root
Sep  9 10:11:36 nativespace-cdp sshd[3943206]: Connection closed by 159.100.136.21 port 57844 [preauth]
Sep  9 10:16:33 nativespace-cdp sshd[3944688]: Connection closed by 159.100.136.21 port 39240 [preauth]
Sep  9 10:21:36 nativespace-cdp sshd[3945846]: Connection closed by 159.100.136.21 port 48346 [preauth]
Sep  9 10:26:33 nativespace-cdp sshd[3947431]: Connection closed by 159.100.136.21 port 57902 [preauth]
Sep  9 10:31:34 nativespace-cdp sshd[3948832]: Connection closed by 159.100.136.21 port 37948 [preauth]
Sep  9 10:33:55 nativespace-cdp sshd[3949307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.5.145.68  user=root
Sep  9 10:33:55 nativespace-cdp sshd[3949307]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 10:33:58 nativespace-cdp sshd[3949307]: Failed password for root from 197.5.145.68 port 4632 ssh2
Sep  9 10:34:00 nativespace-cdp sshd[3949307]: Received disconnect from 197.5.145.68 port 4632:11: Bye Bye [preauth]
Sep  9 10:34:00 nativespace-cdp sshd[3949307]: Disconnected from 197.5.145.68 port 4632 [preauth]
Sep  9 10:36:34 nativespace-cdp sshd[3950038]: Connection closed by 159.100.136.21 port 47490 [preauth]
Sep  9 10:39:54 nativespace-cdp sshd[3950847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.5.145.68  user=root
Sep  9 10:39:54 nativespace-cdp sshd[3950847]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 10:39:56 nativespace-cdp sshd[3950847]: Failed password for root from 197.5.145.68 port 4633 ssh2
Sep  9 10:39:56 nativespace-cdp sshd[3950847]: Received disconnect from 197.5.145.68 port 4633:11: Bye Bye [preauth]
Sep  9 10:39:56 nativespace-cdp sshd[3950847]: Disconnected from 197.5.145.68 port 4633 [preauth]
Sep  9 10:40:44 nativespace-cdp sshd[3951212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.5.145.68  user=root
Sep  9 10:40:44 nativespace-cdp sshd[3951212]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 10:40:46 nativespace-cdp sshd[3951212]: Failed password for root from 197.5.145.68 port 4634 ssh2
Sep  9 10:40:51 nativespace-cdp sshd[3951212]: Received disconnect from 197.5.145.68 port 4634:11: Bye Bye [preauth]
Sep  9 10:40:51 nativespace-cdp sshd[3951212]: Disconnected from 197.5.145.68 port 4634 [preauth]
Sep  9 10:41:33 nativespace-cdp sshd[3951433]: Connection closed by 159.100.136.21 port 56854 [preauth]
Sep  9 10:46:33 nativespace-cdp sshd[3953139]: Connection closed by 159.100.136.21 port 37614 [preauth]
Sep  9 10:51:35 nativespace-cdp sshd[3954553]: Connection closed by 159.100.136.21 port 46788 [preauth]
Sep  9 10:56:33 nativespace-cdp sshd[3955956]: Connection closed by 159.100.136.21 port 56376 [preauth]
Sep  9 11:01:34 nativespace-cdp sshd[3957374]: Connection closed by 159.100.136.21 port 37628 [preauth]
Sep  9 11:06:33 nativespace-cdp sshd[3958701]: Connection closed by 159.100.136.21 port 47508 [preauth]
Sep  9 11:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 11:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:55 nativespace-cdp sudo[3959434]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 11:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:55 nativespace-cdp sudo[3959438]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 11:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:57 nativespace-cdp sudo[3959443]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 11:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:57 nativespace-cdp sudo[3959453]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 11:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:59 nativespace-cdp sudo[3959459]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:59 nativespace-cdp sudo[3959470]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:59 nativespace-cdp sudo[3959475]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:59 nativespace-cdp sudo[3959479]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:59 nativespace-cdp sudo[3959484]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:59 nativespace-cdp sudo[3959490]: pam_unix(sudo:session): session closed for user root
Sep  9 11:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 11:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:09:59 nativespace-cdp sudo[3959496]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 11:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:07 nativespace-cdp sudo[3959636]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 11:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:07 nativespace-cdp sudo[3959640]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=athenare user-2=connect9 user-3=vantagep user-4=maflemin user-5=lbscrmod user-6=markward user-7=foundation user-8=booff user-9=ulsukarm user-10=spectrum user-11=hodgesonweb user-12=theblack user-13=jarvisin user-14=stephani user-15=leereyn1 user-16=still user-17=agproduc user-18=strathar user-19=sarafoundation user-20=atestord user-21=brmrjxl user-22=lakesan1 user-23=musorguk user-24=megacards user-25=wilsonsw user-26=dickemery123 user-27=ptkxhsbt user-28=martsblo user-29=magichat user-30=lbhyisi user-31=hhdugcor user-32=opaiscyx user-33=coursemc user-34=seftvta user-35=jonhartl user-36=ultbcrra user-37=firstres user-38=firstred user-39=southlon user-40=highlegh user-41=firstrel user-42=clarkass user-43=costestimatorco user-44=putterfi user-45=hubmaster user-46=carsinyo user-47=fetch
Sep  9 11:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=milloyco user-49=gilpin user-50=elecleis user-51=connectedshoppin user-52=thqkgnbz user-53=accooper user-54=ianrayne user-55=firstre2 user-56=vivienn1 user-57=battlere user-58=oneoarco user-59=brighto1 user-60=nstriton user-61=belle user-62=ggaaorgu user-63=newstoda user-64=bemadonn user-65=bedfords user-66=alexadmin user-67=skyfirec user-68=nativene user-69=innovat1 user-70=stuartge user-71=askhform user-72=asandcoc user-73=sibtoncc user-74=steve user-75=bwppodcast user-76=zebrapho user-77=nsceres user-78=burydropin user-79=fawcettd user-80=dhyana user-81=beauty user-82=eatspam user-83=darkstar user-84=lkpier user-85=philmcph user-86=ctedorgu user-87=steakbridieme user-88=firstre5 user-89=donnychicago user-90=putterfc user-91=nscdp user-92=health2045 user-93=fortunaz user-94=foods user-95=leftie user-96=hidden user-97=nomistakes user-98=tigerlet user-99=barbersh user-100=isleofwi user-101=smrszyqg
Sep  9 11:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=paulmca1 user-103=pugwash user-104=howardon user-105=cwsocial user-106=cathski user-107=cambria1 user-108=ninejimm user-109=reliable user-110=eugincou user-111=courseme user-112=hirefootballgame user-113=jennimil user-114=tomandle user-115=careers user-116=nbhavers user-117=david user-118=chrisdal user-119=mcdermos user-120=onlycont user-121=attlebor user-122=lucy user-123=romaldki user-124=hodgsonmail user-125=outdoorc user-126=ranxterc user-127=branko user-128=boldover user-129=nove user-130=bakery user-131=sosevalu user-132=crrtipdl user-133=sketchy user-134=cath user-135=havantho user-136=nvihkvu user-137=tstardom user-138=oubpgvbx user-139=what user-140=design user-141=ladburyp user-142=dancinggardener user-143=stagingerris user-144=kategilpin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 11:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 11:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:08 nativespace-cdp sudo[3959644]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep  9 11:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:10 nativespace-cdp sudo[3959657]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep  9 11:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep  9 11:10:10 nativespace-cdp sudo[3959660]: pam_unix(sudo:session): session closed for user onlycont
Sep  9 11:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep  9 11:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:11 nativespace-cdp sudo[3959672]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  9 11:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 11:10:11 nativespace-cdp sudo[3959676]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep  9 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:12 nativespace-cdp sudo[3959697]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep  9 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep  9 11:10:12 nativespace-cdp sudo[3959700]: pam_unix(sudo:session): session closed for user lkpier
Sep  9 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep  9 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:13 nativespace-cdp sudo[3959713]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep  9 11:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep  9 11:10:13 nativespace-cdp sudo[3959718]: pam_unix(sudo:session): session closed for user bwppodcast
Sep  9 11:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep  9 11:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep  9 11:10:13 nativespace-cdp sudo[3959732]: pam_unix(sudo:session): session closed for user oneoarco
Sep  9 11:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep  9 11:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:14 nativespace-cdp sudo[3959745]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep  9 11:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep  9 11:10:14 nativespace-cdp sudo[3959751]: pam_unix(sudo:session): session closed for user fortunaz
Sep  9 11:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep  9 11:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:14 nativespace-cdp sudo[3959762]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 11:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:14 nativespace-cdp sudo[3959765]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep  9 11:10:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:31 nativespace-cdp sudo[3960705]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep  9 11:10:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:31 nativespace-cdp sudo[3960709]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 11:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:33 nativespace-cdp sudo[3960716]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vFjAl38jRGxXWPY7.~
Sep  9 11:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:33 nativespace-cdp sudo[3960720]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vFjAl38jRGxXWPY7.~'
Sep  9 11:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:33 nativespace-cdp sudo[3960724]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vFjAl38jRGxXWPY7.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 11:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:33 nativespace-cdp sudo[3960728]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 11:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:33 nativespace-cdp sudo[3960731]: pam_unix(sudo:session): session closed for user root
Sep  9 11:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 11:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 11:10:39 nativespace-cdp sudo[3960823]: pam_unix(sudo:session): session closed for user root
Sep  9 11:11:33 nativespace-cdp sshd[3961014]: Connection closed by 159.100.136.21 port 56994 [preauth]
Sep  9 11:16:34 nativespace-cdp sshd[3962534]: Connection closed by 159.100.136.21 port 38012 [preauth]
Sep  9 11:21:33 nativespace-cdp sshd[3963900]: Connection closed by 159.100.136.21 port 47082 [preauth]
Sep  9 11:26:34 nativespace-cdp sshd[3965702]: Connection closed by 159.100.136.21 port 56266 [preauth]
Sep  9 11:31:33 nativespace-cdp sshd[3967114]: Connection closed by 159.100.136.21 port 37208 [preauth]
Sep  9 11:36:33 nativespace-cdp sshd[3968331]: Connection closed by 159.100.136.21 port 47048 [preauth]
Sep  9 11:41:34 nativespace-cdp sshd[3969857]: Connection closed by 159.100.136.21 port 55818 [preauth]
Sep  9 11:46:34 nativespace-cdp sshd[3971295]: Connection closed by 159.100.136.21 port 36944 [preauth]
Sep  9 11:51:33 nativespace-cdp sshd[3972543]: Connection closed by 159.100.136.21 port 46602 [preauth]
Sep  9 11:56:37 nativespace-cdp sshd[3974019]: Connection closed by 159.100.136.21 port 56320 [preauth]
Sep  9 12:01:35 nativespace-cdp sshd[3975577]: Connection closed by 159.100.136.21 port 37082 [preauth]
Sep  9 12:06:33 nativespace-cdp sshd[3977066]: Connection closed by 159.100.136.21 port 46362 [preauth]
Sep  9 12:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 12:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:48 nativespace-cdp sudo[3977805]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 12:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:48 nativespace-cdp sudo[3977810]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 12:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:48 nativespace-cdp sudo[3977815]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 12:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:49 nativespace-cdp sudo[3977829]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 12:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:51 nativespace-cdp sudo[3977835]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 12:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:51 nativespace-cdp sudo[3977848]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 12:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:51 nativespace-cdp sudo[3977853]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 12:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:51 nativespace-cdp sudo[3977857]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 12:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:51 nativespace-cdp sudo[3977862]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 12:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:51 nativespace-cdp sudo[3977869]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 12:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:51 nativespace-cdp sudo[3977875]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 12:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:53 nativespace-cdp sudo[3977891]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 12:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:53 nativespace-cdp sudo[3977898]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=lbscrmod user-3=maflemin user-4=vantagep user-5=connect9 user-6=athenare user-7=booff user-8=markward user-9=foundation user-10=leereyn1 user-11=stephani user-12=agproduc user-13=still user-14=hodgesonweb user-15=theblack user-16=spectrum user-17=jarvisin user-18=megacards user-19=musorguk user-20=wilsonsw user-21=atestord user-22=sarafoundation user-23=strathar user-24=brmrjxl user-25=lakesan1 user-26=magichat user-27=hhdugcor user-28=lbhyisi user-29=ptkxhsbt user-30=dickemery123 user-31=martsblo user-32=highlegh user-33=southlon user-34=firstred user-35=costestimatorco user-36=clarkass user-37=firstrel user-38=coursemc user-39=opaiscyx user-40=firstres user-41=ultbcrra user-42=jonhartl user-43=seftvta user-44=thqkgnbz user-45=connectedshoppin user-46=ianrayne user-47=accooper
Sep  9 12:09:53 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=fetch user-49=carsinyo user-50=hubmaster user-51=putterfi user-52=elecleis user-53=milloyco user-54=gilpin user-55=bemadonn user-56=newstoda user-57=ggaaorgu user-58=belle user-59=bedfords user-60=oneoarco user-61=battlere user-62=vivienn1 user-63=firstre2 user-64=nstriton user-65=brighto1 user-66=nativene user-67=stuartge user-68=askhform user-69=innovat1 user-70=alexadmin user-71=skyfirec user-72=steve user-73=zebrapho user-74=bwppodcast user-75=sibtoncc user-76=asandcoc user-77=dhyana user-78=darkstar user-79=eatspam user-80=beauty user-81=nsceres user-82=fawcettd user-83=burydropin user-84=barbersh user-85=tigerlet user-86=nomistakes user-87=hidden user-88=smrszyqg user-89=isleofwi user-90=steakbridieme user-91=firstre5 user-92=donnychicago user-93=ctedorgu user-94=philmcph user-95=lkpier user-96=foods user-97=leftie user-98=fortunaz user-99=health2045 user-100=nscdp user-101=putterfc
Sep  9 12:09:53 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=courseme user-103=eugincou user-104=hirefootballgame user-105=cwsocial user-106=howardon user-107=paulmca1 user-108=pugwash user-109=ninejimm user-110=reliable user-111=cambria1 user-112=cathski user-113=david user-114=careers user-115=nbhavers user-116=mcdermos user-117=chrisdal user-118=jennimil user-119=tomandle user-120=romaldki user-121=branko user-122=outdoorc user-123=hodgsonmail user-124=ranxterc user-125=onlycont user-126=lucy user-127=attlebor user-128=crrtipdl user-129=sosevalu user-130=bakery user-131=boldover user-132=nove user-133=design user-134=kategilpin user-135=dancinggardener user-136=stagingerris user-137=ladburyp user-138=nvihkvu user-139=havantho user-140=sketchy user-141=cath user-142=what user-143=oubpgvbx user-144=tstardom feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 12:09:53 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 12:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:54 nativespace-cdp sudo[3977904]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 12:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:54 nativespace-cdp sudo[3977914]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Qlh3wKH5iAolQgHm.~
Sep  9 12:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:54 nativespace-cdp sudo[3977920]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Qlh3wKH5iAolQgHm.~'
Sep  9 12:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:55 nativespace-cdp sudo[3977924]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Qlh3wKH5iAolQgHm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 12:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:55 nativespace-cdp sudo[3977930]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 12:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:55 nativespace-cdp sudo[3977935]: pam_unix(sudo:session): session closed for user root
Sep  9 12:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 12:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 12:09:56 nativespace-cdp sudo[3977958]: pam_unix(sudo:session): session closed for user root
Sep  9 12:11:35 nativespace-cdp sshd[3978520]: Connection closed by 159.100.136.21 port 54838 [preauth]
Sep  9 12:16:41 nativespace-cdp sshd[3980205]: Did not receive identification string from 159.100.136.21 port 36366
Sep  9 12:21:34 nativespace-cdp sshd[3981476]: Connection closed by 159.100.136.21 port 45604 [preauth]
Sep  9 12:23:23 nativespace-cdp sshd[3981902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.67.70.198  user=root
Sep  9 12:23:23 nativespace-cdp sshd[3981902]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:23:25 nativespace-cdp sshd[3981902]: Failed password for root from 36.67.70.198 port 41108 ssh2
Sep  9 12:23:25 nativespace-cdp sshd[3981902]: Received disconnect from 36.67.70.198 port 41108:11: Bye Bye [preauth]
Sep  9 12:23:25 nativespace-cdp sshd[3981902]: Disconnected from 36.67.70.198 port 41108 [preauth]
Sep  9 12:24:39 nativespace-cdp sshd[3982138]: Invalid user novak from 47.240.45.5 port 8150
Sep  9 12:24:39 nativespace-cdp sshd[3982138]: input_userauth_request: invalid user novak [preauth]
Sep  9 12:24:39 nativespace-cdp sshd[3982138]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:24:39 nativespace-cdp sshd[3982138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.240.45.5
Sep  9 12:24:41 nativespace-cdp sshd[3982138]: Failed password for invalid user novak from 47.240.45.5 port 8150 ssh2
Sep  9 12:24:43 nativespace-cdp sshd[3982138]: Received disconnect from 47.240.45.5 port 8150:11: Bye Bye [preauth]
Sep  9 12:24:43 nativespace-cdp sshd[3982138]: Disconnected from 47.240.45.5 port 8150 [preauth]
Sep  9 12:25:08 nativespace-cdp sshd[3982299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.52.226.14  user=root
Sep  9 12:25:08 nativespace-cdp sshd[3982299]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:25:11 nativespace-cdp sshd[3982299]: Failed password for root from 60.52.226.14 port 33832 ssh2
Sep  9 12:25:13 nativespace-cdp sshd[3982299]: Received disconnect from 60.52.226.14 port 33832:11: Bye Bye [preauth]
Sep  9 12:25:13 nativespace-cdp sshd[3982299]: Disconnected from 60.52.226.14 port 33832 [preauth]
Sep  9 12:25:17 nativespace-cdp sshd[3982337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.217.28  user=root
Sep  9 12:25:17 nativespace-cdp sshd[3982337]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:25:19 nativespace-cdp sshd[3982337]: Failed password for root from 14.63.217.28 port 41398 ssh2
Sep  9 12:25:19 nativespace-cdp sshd[3982337]: Received disconnect from 14.63.217.28 port 41398:11: Bye Bye [preauth]
Sep  9 12:25:19 nativespace-cdp sshd[3982337]: Disconnected from 14.63.217.28 port 41398 [preauth]
Sep  9 12:25:28 nativespace-cdp sshd[3982368]: Invalid user naoya from 168.75.93.1 port 34358
Sep  9 12:25:28 nativespace-cdp sshd[3982368]: input_userauth_request: invalid user naoya [preauth]
Sep  9 12:25:28 nativespace-cdp sshd[3982368]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:25:28 nativespace-cdp sshd[3982368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.75.93.1
Sep  9 12:25:30 nativespace-cdp sshd[3982368]: Failed password for invalid user naoya from 168.75.93.1 port 34358 ssh2
Sep  9 12:25:30 nativespace-cdp sshd[3982368]: Received disconnect from 168.75.93.1 port 34358:11: Bye Bye [preauth]
Sep  9 12:25:30 nativespace-cdp sshd[3982368]: Disconnected from 168.75.93.1 port 34358 [preauth]
Sep  9 12:25:52 nativespace-cdp sshd[3982472]: Invalid user luke from 47.240.45.5 port 28982
Sep  9 12:25:52 nativespace-cdp sshd[3982472]: input_userauth_request: invalid user luke [preauth]
Sep  9 12:25:52 nativespace-cdp sshd[3982472]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:25:52 nativespace-cdp sshd[3982472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.240.45.5
Sep  9 12:25:54 nativespace-cdp sshd[3982472]: Failed password for invalid user luke from 47.240.45.5 port 28982 ssh2
Sep  9 12:25:57 nativespace-cdp sshd[3982472]: Received disconnect from 47.240.45.5 port 28982:11: Bye Bye [preauth]
Sep  9 12:25:57 nativespace-cdp sshd[3982472]: Disconnected from 47.240.45.5 port 28982 [preauth]
Sep  9 12:26:04 nativespace-cdp sshd[3982536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.82.89  user=root
Sep  9 12:26:04 nativespace-cdp sshd[3982536]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:26:06 nativespace-cdp sshd[3982536]: Failed password for root from 46.101.82.89 port 37102 ssh2
Sep  9 12:26:13 nativespace-cdp sshd[3982536]: Received disconnect from 46.101.82.89 port 37102:11: Bye Bye [preauth]
Sep  9 12:26:13 nativespace-cdp sshd[3982536]: Disconnected from 46.101.82.89 port 37102 [preauth]
Sep  9 12:26:34 nativespace-cdp sshd[3982964]: Connection closed by 159.100.136.21 port 55224 [preauth]
Sep  9 12:26:43 nativespace-cdp sshd[3982973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.240.45.5  user=ftp
Sep  9 12:26:43 nativespace-cdp sshd[3982973]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "ftp"
Sep  9 12:26:45 nativespace-cdp sshd[3982973]: Failed password for ftp from 47.240.45.5 port 43176 ssh2
Sep  9 12:26:45 nativespace-cdp sshd[3982973]: Received disconnect from 47.240.45.5 port 43176:11: Bye Bye [preauth]
Sep  9 12:26:45 nativespace-cdp sshd[3982973]: Disconnected from 47.240.45.5 port 43176 [preauth]
Sep  9 12:27:51 nativespace-cdp sshd[3983223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.146.239  user=root
Sep  9 12:27:51 nativespace-cdp sshd[3983223]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:27:53 nativespace-cdp sshd[3983223]: Failed password for root from 143.198.146.239 port 40932 ssh2
Sep  9 12:27:53 nativespace-cdp sshd[3983223]: Received disconnect from 143.198.146.239 port 40932:11: Bye Bye [preauth]
Sep  9 12:27:53 nativespace-cdp sshd[3983223]: Disconnected from 143.198.146.239 port 40932 [preauth]
Sep  9 12:28:15 nativespace-cdp sshd[3983393]: Invalid user ban from 103.191.178.123 port 52496
Sep  9 12:28:15 nativespace-cdp sshd[3983393]: input_userauth_request: invalid user ban [preauth]
Sep  9 12:28:15 nativespace-cdp sshd[3983393]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:28:15 nativespace-cdp sshd[3983393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.178.123
Sep  9 12:28:17 nativespace-cdp sshd[3983393]: Failed password for invalid user ban from 103.191.178.123 port 52496 ssh2
Sep  9 12:28:17 nativespace-cdp sshd[3983393]: Received disconnect from 103.191.178.123 port 52496:11: Bye Bye [preauth]
Sep  9 12:28:17 nativespace-cdp sshd[3983393]: Disconnected from 103.191.178.123 port 52496 [preauth]
Sep  9 12:29:37 nativespace-cdp sshd[3983629]: Invalid user manjunath from 104.225.159.240 port 33448
Sep  9 12:29:37 nativespace-cdp sshd[3983629]: input_userauth_request: invalid user manjunath [preauth]
Sep  9 12:29:37 nativespace-cdp sshd[3983629]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:29:37 nativespace-cdp sshd[3983629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.225.159.240
Sep  9 12:29:37 nativespace-cdp sshd[3983633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.40.19.68  user=root
Sep  9 12:29:37 nativespace-cdp sshd[3983633]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:29:39 nativespace-cdp sshd[3983629]: Failed password for invalid user manjunath from 104.225.159.240 port 33448 ssh2
Sep  9 12:29:39 nativespace-cdp sshd[3983633]: Failed password for root from 74.40.19.68 port 44722 ssh2
Sep  9 12:29:41 nativespace-cdp sshd[3983629]: Received disconnect from 104.225.159.240 port 33448:11: Bye Bye [preauth]
Sep  9 12:29:41 nativespace-cdp sshd[3983629]: Disconnected from 104.225.159.240 port 33448 [preauth]
Sep  9 12:29:42 nativespace-cdp sshd[3983633]: Received disconnect from 74.40.19.68 port 44722:11: Bye Bye [preauth]
Sep  9 12:29:42 nativespace-cdp sshd[3983633]: Disconnected from 74.40.19.68 port 44722 [preauth]
Sep  9 12:30:14 nativespace-cdp sshd[3983888]: Invalid user tomcat from 36.67.70.198 port 42124
Sep  9 12:30:14 nativespace-cdp sshd[3983888]: input_userauth_request: invalid user tomcat [preauth]
Sep  9 12:30:14 nativespace-cdp sshd[3983888]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:30:14 nativespace-cdp sshd[3983888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.67.70.198
Sep  9 12:30:15 nativespace-cdp sshd[3983897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.146.239  user=root
Sep  9 12:30:15 nativespace-cdp sshd[3983897]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:30:16 nativespace-cdp sshd[3983888]: Failed password for invalid user tomcat from 36.67.70.198 port 42124 ssh2
Sep  9 12:30:17 nativespace-cdp sshd[3983897]: Failed password for root from 143.198.146.239 port 42410 ssh2
Sep  9 12:30:19 nativespace-cdp sshd[3983888]: Received disconnect from 36.67.70.198 port 42124:11: Bye Bye [preauth]
Sep  9 12:30:19 nativespace-cdp sshd[3983888]: Disconnected from 36.67.70.198 port 42124 [preauth]
Sep  9 12:30:25 nativespace-cdp sshd[3983921]: Invalid user nagios from 60.52.226.14 port 55003
Sep  9 12:30:25 nativespace-cdp sshd[3983921]: input_userauth_request: invalid user nagios [preauth]
Sep  9 12:30:25 nativespace-cdp sshd[3983921]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:30:25 nativespace-cdp sshd[3983921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.52.226.14
Sep  9 12:30:27 nativespace-cdp sshd[3983921]: Failed password for invalid user nagios from 60.52.226.14 port 55003 ssh2
Sep  9 12:30:31 nativespace-cdp sshd[3983938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.40.19.68  user=root
Sep  9 12:30:31 nativespace-cdp sshd[3983938]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:30:31 nativespace-cdp sshd[3983921]: Received disconnect from 60.52.226.14 port 55003:11: Bye Bye [preauth]
Sep  9 12:30:31 nativespace-cdp sshd[3983921]: Disconnected from 60.52.226.14 port 55003 [preauth]
Sep  9 12:30:33 nativespace-cdp sshd[3983938]: Failed password for root from 74.40.19.68 port 55544 ssh2
Sep  9 12:30:33 nativespace-cdp sshd[3983938]: Received disconnect from 74.40.19.68 port 55544:11: Bye Bye [preauth]
Sep  9 12:30:33 nativespace-cdp sshd[3983938]: Disconnected from 74.40.19.68 port 55544 [preauth]
Sep  9 12:30:35 nativespace-cdp sshd[3983963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.172.117.17  user=root
Sep  9 12:30:35 nativespace-cdp sshd[3983963]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:30:37 nativespace-cdp sshd[3983963]: Failed password for root from 34.172.117.17 port 52404 ssh2
Sep  9 12:30:39 nativespace-cdp sshd[3983963]: Received disconnect from 34.172.117.17 port 52404:11: Bye Bye [preauth]
Sep  9 12:30:39 nativespace-cdp sshd[3983963]: Disconnected from 34.172.117.17 port 52404 [preauth]
Sep  9 12:30:42 nativespace-cdp sshd[3984037]: Invalid user lihong from 46.101.82.89 port 36268
Sep  9 12:30:42 nativespace-cdp sshd[3984037]: input_userauth_request: invalid user lihong [preauth]
Sep  9 12:30:42 nativespace-cdp sshd[3984037]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:30:42 nativespace-cdp sshd[3984037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.82.89
Sep  9 12:30:42 nativespace-cdp sshd[3983897]: Received disconnect from 143.198.146.239 port 42410:11: Bye Bye [preauth]
Sep  9 12:30:42 nativespace-cdp sshd[3983897]: Disconnected from 143.198.146.239 port 42410 [preauth]
Sep  9 12:30:44 nativespace-cdp sshd[3984037]: Failed password for invalid user lihong from 46.101.82.89 port 36268 ssh2
Sep  9 12:30:45 nativespace-cdp sshd[3984037]: Received disconnect from 46.101.82.89 port 36268:11: Bye Bye [preauth]
Sep  9 12:30:45 nativespace-cdp sshd[3984037]: Disconnected from 46.101.82.89 port 36268 [preauth]
Sep  9 12:31:09 nativespace-cdp sshd[3984176]: Invalid user tomcat from 143.198.146.239 port 36222
Sep  9 12:31:09 nativespace-cdp sshd[3984176]: input_userauth_request: invalid user tomcat [preauth]
Sep  9 12:31:09 nativespace-cdp sshd[3984176]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:31:09 nativespace-cdp sshd[3984176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.146.239
Sep  9 12:31:09 nativespace-cdp sshd[3984174]: Invalid user haris from 103.191.178.123 port 37172
Sep  9 12:31:09 nativespace-cdp sshd[3984174]: input_userauth_request: invalid user haris [preauth]
Sep  9 12:31:09 nativespace-cdp sshd[3984174]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:31:09 nativespace-cdp sshd[3984174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.178.123
Sep  9 12:31:11 nativespace-cdp sshd[3984176]: Failed password for invalid user tomcat from 143.198.146.239 port 36222 ssh2
Sep  9 12:31:11 nativespace-cdp sshd[3984176]: Received disconnect from 143.198.146.239 port 36222:11: Bye Bye [preauth]
Sep  9 12:31:11 nativespace-cdp sshd[3984176]: Disconnected from 143.198.146.239 port 36222 [preauth]
Sep  9 12:31:11 nativespace-cdp sshd[3984174]: Failed password for invalid user haris from 103.191.178.123 port 37172 ssh2
Sep  9 12:31:12 nativespace-cdp sshd[3984174]: Received disconnect from 103.191.178.123 port 37172:11: Bye Bye [preauth]
Sep  9 12:31:12 nativespace-cdp sshd[3984174]: Disconnected from 103.191.178.123 port 37172 [preauth]
Sep  9 12:31:12 nativespace-cdp sshd[3984172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.217.28  user=root
Sep  9 12:31:12 nativespace-cdp sshd[3984172]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:31:12 nativespace-cdp sshd[3984170]: Invalid user middleware from 36.67.70.198 port 47638
Sep  9 12:31:12 nativespace-cdp sshd[3984170]: input_userauth_request: invalid user middleware [preauth]
Sep  9 12:31:12 nativespace-cdp sshd[3984170]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:31:12 nativespace-cdp sshd[3984170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.67.70.198
Sep  9 12:31:13 nativespace-cdp sshd[3984172]: Failed password for root from 14.63.217.28 port 56982 ssh2
Sep  9 12:31:13 nativespace-cdp sshd[3984170]: Failed password for invalid user middleware from 36.67.70.198 port 47638 ssh2
Sep  9 12:31:13 nativespace-cdp sshd[3984172]: Received disconnect from 14.63.217.28 port 56982:11: Bye Bye [preauth]
Sep  9 12:31:13 nativespace-cdp sshd[3984172]: Disconnected from 14.63.217.28 port 56982 [preauth]
Sep  9 12:31:13 nativespace-cdp sshd[3984170]: Received disconnect from 36.67.70.198 port 47638:11: Bye Bye [preauth]
Sep  9 12:31:13 nativespace-cdp sshd[3984170]: Disconnected from 36.67.70.198 port 47638 [preauth]
Sep  9 12:31:14 nativespace-cdp sshd[3984194]: Did not receive identification string from 167.94.145.98 port 57618
Sep  9 12:31:14 nativespace-cdp sshd[3984227]: Invalid user songyan from 168.75.93.1 port 56872
Sep  9 12:31:14 nativespace-cdp sshd[3984227]: input_userauth_request: invalid user songyan [preauth]
Sep  9 12:31:14 nativespace-cdp sshd[3984227]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:31:14 nativespace-cdp sshd[3984227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.75.93.1
Sep  9 12:31:16 nativespace-cdp sshd[3984227]: Failed password for invalid user songyan from 168.75.93.1 port 56872 ssh2
Sep  9 12:31:20 nativespace-cdp sshd[3984227]: Received disconnect from 168.75.93.1 port 56872:11: Bye Bye [preauth]
Sep  9 12:31:20 nativespace-cdp sshd[3984227]: Disconnected from 168.75.93.1 port 56872 [preauth]
Sep  9 12:31:21 nativespace-cdp sshd[3984263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.40.19.68  user=root
Sep  9 12:31:21 nativespace-cdp sshd[3984263]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:31:22 nativespace-cdp sshd[3984276]: Invalid user facebook from 46.101.82.89 port 36368
Sep  9 12:31:22 nativespace-cdp sshd[3984276]: input_userauth_request: invalid user facebook [preauth]
Sep  9 12:31:22 nativespace-cdp sshd[3984276]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:31:22 nativespace-cdp sshd[3984276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.82.89
Sep  9 12:31:22 nativespace-cdp sshd[3984272]: Invalid user lasse from 60.52.226.14 port 34636
Sep  9 12:31:22 nativespace-cdp sshd[3984272]: input_userauth_request: invalid user lasse [preauth]
Sep  9 12:31:22 nativespace-cdp sshd[3984272]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:31:22 nativespace-cdp sshd[3984272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.52.226.14
Sep  9 12:31:24 nativespace-cdp sshd[3984263]: Failed password for root from 74.40.19.68 port 59310 ssh2
Sep  9 12:31:24 nativespace-cdp sshd[3984263]: Received disconnect from 74.40.19.68 port 59310:11: Bye Bye [preauth]
Sep  9 12:31:24 nativespace-cdp sshd[3984263]: Disconnected from 74.40.19.68 port 59310 [preauth]
Sep  9 12:31:24 nativespace-cdp sshd[3984276]: Failed password for invalid user facebook from 46.101.82.89 port 36368 ssh2
Sep  9 12:31:24 nativespace-cdp sshd[3984276]: Received disconnect from 46.101.82.89 port 36368:11: Bye Bye [preauth]
Sep  9 12:31:24 nativespace-cdp sshd[3984276]: Disconnected from 46.101.82.89 port 36368 [preauth]
Sep  9 12:31:24 nativespace-cdp sshd[3984272]: Failed password for invalid user lasse from 60.52.226.14 port 34636 ssh2
Sep  9 12:31:25 nativespace-cdp sshd[3984272]: Received disconnect from 60.52.226.14 port 34636:11: Bye Bye [preauth]
Sep  9 12:31:25 nativespace-cdp sshd[3984272]: Disconnected from 60.52.226.14 port 34636 [preauth]
Sep  9 12:31:33 nativespace-cdp sshd[3984426]: Connection closed by 159.100.136.21 port 36332 [preauth]
Sep  9 12:31:36 nativespace-cdp sshd[3984267]: Connection closed by 167.94.145.98 port 42590 [preauth]
Sep  9 12:31:59 nativespace-cdp sshd[3984490]: Invalid user ubuntu from 14.63.217.28 port 41740
Sep  9 12:31:59 nativespace-cdp sshd[3984490]: input_userauth_request: invalid user ubuntu [preauth]
Sep  9 12:31:59 nativespace-cdp sshd[3984490]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:31:59 nativespace-cdp sshd[3984490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.217.28
Sep  9 12:32:00 nativespace-cdp sshd[3984496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.75.93.1  user=root
Sep  9 12:32:00 nativespace-cdp sshd[3984496]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:32:01 nativespace-cdp sshd[3984490]: Failed password for invalid user ubuntu from 14.63.217.28 port 41740 ssh2
Sep  9 12:32:02 nativespace-cdp sshd[3984496]: Failed password for root from 168.75.93.1 port 53614 ssh2
Sep  9 12:32:03 nativespace-cdp sshd[3984496]: Received disconnect from 168.75.93.1 port 53614:11: Bye Bye [preauth]
Sep  9 12:32:03 nativespace-cdp sshd[3984496]: Disconnected from 168.75.93.1 port 53614 [preauth]
Sep  9 12:32:03 nativespace-cdp sshd[3984490]: Received disconnect from 14.63.217.28 port 41740:11: Bye Bye [preauth]
Sep  9 12:32:03 nativespace-cdp sshd[3984490]: Disconnected from 14.63.217.28 port 41740 [preauth]
Sep  9 12:32:05 nativespace-cdp sshd[3984533]: Invalid user naoya from 103.191.178.123 port 56192
Sep  9 12:32:05 nativespace-cdp sshd[3984533]: input_userauth_request: invalid user naoya [preauth]
Sep  9 12:32:05 nativespace-cdp sshd[3984533]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:32:05 nativespace-cdp sshd[3984533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.178.123
Sep  9 12:32:07 nativespace-cdp sshd[3984533]: Failed password for invalid user naoya from 103.191.178.123 port 56192 ssh2
Sep  9 12:32:19 nativespace-cdp sshd[3984637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.172.117.17  user=root
Sep  9 12:32:19 nativespace-cdp sshd[3984637]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:32:21 nativespace-cdp sshd[3984637]: Failed password for root from 34.172.117.17 port 53782 ssh2
Sep  9 12:32:21 nativespace-cdp sshd[3984637]: Received disconnect from 34.172.117.17 port 53782:11: Bye Bye [preauth]
Sep  9 12:32:21 nativespace-cdp sshd[3984637]: Disconnected from 34.172.117.17 port 53782 [preauth]
Sep  9 12:33:09 nativespace-cdp sshd[3984876]: Invalid user middleware from 34.172.117.17 port 44958
Sep  9 12:33:09 nativespace-cdp sshd[3984876]: input_userauth_request: invalid user middleware [preauth]
Sep  9 12:33:09 nativespace-cdp sshd[3984876]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 12:33:09 nativespace-cdp sshd[3984876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.172.117.17
Sep  9 12:33:11 nativespace-cdp sshd[3984876]: Failed password for invalid user middleware from 34.172.117.17 port 44958 ssh2
Sep  9 12:33:11 nativespace-cdp sshd[3984876]: Received disconnect from 34.172.117.17 port 44958:11: Bye Bye [preauth]
Sep  9 12:33:11 nativespace-cdp sshd[3984876]: Disconnected from 34.172.117.17 port 44958 [preauth]
Sep  9 12:35:48 nativespace-cdp sshd[3985525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.225.159.240  user=root
Sep  9 12:35:48 nativespace-cdp sshd[3985525]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 12:35:50 nativespace-cdp sshd[3985525]: Failed password for root from 104.225.159.240 port 33608 ssh2
Sep  9 12:35:51 nativespace-cdp sshd[3985525]: Received disconnect from 104.225.159.240 port 33608:11: Bye Bye [preauth]
Sep  9 12:35:51 nativespace-cdp sshd[3985525]: Disconnected from 104.225.159.240 port 33608 [preauth]
Sep  9 12:36:33 nativespace-cdp sshd[3985680]: Connection closed by 159.100.136.21 port 45796 [preauth]
Sep  9 12:37:15 nativespace-cdp sshd[3985797]: Connection closed by 104.225.159.240 port 33666 [preauth]
Sep  9 12:38:34 nativespace-cdp sshd[3986168]: Connection closed by 104.225.159.240 port 33726 [preauth]
Sep  9 12:39:46 nativespace-cdp sshd[3986435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.225.159.240  user=ftp
Sep  9 12:39:46 nativespace-cdp sshd[3986435]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "ftp"
Sep  9 12:39:48 nativespace-cdp sshd[3986435]: Failed password for ftp from 104.225.159.240 port 33782 ssh2
Sep  9 12:39:48 nativespace-cdp sshd[3986435]: Received disconnect from 104.225.159.240 port 33782:11: Bye Bye [preauth]
Sep  9 12:39:48 nativespace-cdp sshd[3986435]: Disconnected from 104.225.159.240 port 33782 [preauth]
Sep  9 12:41:33 nativespace-cdp sshd[3987349]: Connection closed by 159.100.136.21 port 54152 [preauth]
Sep  9 12:46:33 nativespace-cdp sshd[3988715]: Connection closed by 159.100.136.21 port 35592 [preauth]
Sep  9 12:51:34 nativespace-cdp sshd[3989984]: Connection closed by 159.100.136.21 port 44548 [preauth]
Sep  9 12:56:34 nativespace-cdp sshd[3991379]: Connection reset by 159.100.136.21 port 54240 [preauth]
Sep  9 13:01:33 nativespace-cdp sshd[3993028]: Connection closed by 159.100.136.21 port 34816 [preauth]
Sep  9 13:06:36 nativespace-cdp sshd[3994217]: Connection closed by 159.100.136.21 port 44242 [preauth]
Sep  9 13:11:38 nativespace-cdp sshd[3995303]: Connection closed by 159.100.136.21 port 52762 [preauth]
Sep  9 13:16:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 13:16:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:02 nativespace-cdp sudo[3997324]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 13:16:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:02 nativespace-cdp sudo[3997356]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 13:16:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:10 nativespace-cdp sudo[3997359]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 13:16:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:10 nativespace-cdp sudo[3997439]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 13:16:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:34 nativespace-cdp sshd[3997578]: Connection closed by 159.100.136.21 port 33678 [preauth]
Sep  9 13:16:43 nativespace-cdp sudo[3997442]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 13:16:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:45 nativespace-cdp sudo[3997673]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 13:16:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:45 nativespace-cdp sudo[3997677]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 13:16:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:45 nativespace-cdp sudo[3997680]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 13:16:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:45 nativespace-cdp sudo[3997683]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 13:16:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:45 nativespace-cdp sudo[3997686]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 13:16:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:45 nativespace-cdp sudo[3997689]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 13:16:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:53 nativespace-cdp sudo[3997757]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 13:16:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:16:57 nativespace-cdp sudo[3997766]: pam_unix(sudo:session): session closed for user root
Sep  9 13:16:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=firstred user-2=highlegh user-3=southlon user-4=clarkass user-5=firstrel user-6=costestimatorco user-7=coursemc user-8=opaiscyx user-9=ultbcrra user-10=seftvta user-11=jonhartl user-12=firstres user-13=connectedshoppin user-14=thqkgnbz user-15=accooper user-16=ianrayne user-17=hubmaster user-18=putterfi user-19=fetch user-20=carsinyo user-21=gilpin user-22=milloyco user-23=elecleis user-24=newstoda user-25=ggaaorgu user-26=belle user-27=bemadonn user-28=bedfords user-29=vivienn1 user-30=firstre2 user-31=oneoarco user-32=battlere user-33=nstriton user-34=brighto1 user-35=nativene user-36=innovat1 user-37=askhform user-38=stuartge user-39=skyfirec user-40=alexadmin user-41=ulsukarm user-42=vantagep user-43=connect9 user-44=athenare user-45=lbscrmod user-46=maflemin user-47=markward
Sep  9 13:16:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=foundation user-49=booff user-50=stephani user-51=leereyn1 user-52=agproduc user-53=still user-54=spectrum user-55=theblack user-56=hodgesonweb user-57=jarvisin user-58=megacards user-59=musorguk user-60=wilsonsw user-61=strathar user-62=atestord user-63=sarafoundation user-64=lakesan1 user-65=brmrjxl user-66=magichat user-67=hhdugcor user-68=lbhyisi user-69=dickemery123 user-70=ptkxhsbt user-71=martsblo user-72=david user-73=careers user-74=nbhavers user-75=chrisdal user-76=mcdermos user-77=jennimil user-78=tomandle user-79=romaldki user-80=outdoorc user-81=ranxterc user-82=hodgsonmail user-83=branko user-84=onlycont user-85=lucy user-86=attlebor user-87=bakery user-88=crrtipdl user-89=sosevalu user-90=boldover user-91=nove user-92=design user-93=stagingerris user-94=dancinggardener user-95=ladburyp user-96=kategilpin user-97=havantho user-98=sketchy user-99=cath user-100=nvihkvu user-101=tstardom
Sep  9 13:16:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=oubpgvbx user-103=what user-104=steve user-105=bwppodcast user-106=zebrapho user-107=asandcoc user-108=sibtoncc user-109=dhyana user-110=beauty user-111=darkstar user-112=eatspam user-113=nsceres user-114=fawcettd user-115=burydropin user-116=nomistakes user-117=hidden user-118=barbersh user-119=tigerlet user-120=isleofwi user-121=smrszyqg user-122=lkpier user-123=firstre5 user-124=donnychicago user-125=steakbridieme user-126=ctedorgu user-127=philmcph user-128=nscdp user-129=putterfc user-130=foods user-131=leftie user-132=health2045 user-133=fortunaz user-134=eugincou user-135=courseme user-136=hirefootballgame user-137=cwsocial user-138=howardon user-139=pugwash user-140=paulmca1 user-141=cathski user-142=cambria1 user-143=reliable user-144=ninejimm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 13:16:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 13:16:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:17:01 nativespace-cdp sudo[3997792]: pam_unix(sudo:session): session closed for user root
Sep  9 13:17:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 13:17:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:17:02 nativespace-cdp sudo[3997835]: pam_unix(sudo:session): session closed for user root
Sep  9 13:17:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-JBlScwLpcTuyWp6p.~
Sep  9 13:17:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:17:03 nativespace-cdp sudo[3997841]: pam_unix(sudo:session): session closed for user root
Sep  9 13:17:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-JBlScwLpcTuyWp6p.~'
Sep  9 13:17:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:17:03 nativespace-cdp sudo[3997846]: pam_unix(sudo:session): session closed for user root
Sep  9 13:17:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-JBlScwLpcTuyWp6p.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 13:17:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:17:03 nativespace-cdp sudo[3997851]: pam_unix(sudo:session): session closed for user root
Sep  9 13:17:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 13:17:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:17:03 nativespace-cdp sudo[3997856]: pam_unix(sudo:session): session closed for user root
Sep  9 13:18:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 13:18:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 13:18:45 nativespace-cdp sudo[3998243]: pam_unix(sudo:session): session closed for user root
Sep  9 13:21:33 nativespace-cdp sshd[3999613]: Connection closed by 159.100.136.21 port 42914 [preauth]
Sep  9 13:26:33 nativespace-cdp sshd[4002098]: Connection closed by 159.100.136.21 port 51654 [preauth]
Sep  9 13:31:36 nativespace-cdp sshd[4004387]: Connection closed by 159.100.136.21 port 59896 [preauth]
Sep  9 13:36:35 nativespace-cdp sshd[4007299]: Connection closed by 159.100.136.21 port 41076 [preauth]
Sep  9 13:41:33 nativespace-cdp sshd[4010477]: Connection closed by 159.100.136.21 port 50438 [preauth]
Sep  9 13:46:35 nativespace-cdp sshd[4011653]: Connection closed by 159.100.136.21 port 60042 [preauth]
Sep  9 13:51:33 nativespace-cdp sshd[4012828]: Connection closed by 159.100.136.21 port 40452 [preauth]
Sep  9 13:56:35 nativespace-cdp sshd[4014080]: Connection closed by 159.100.136.21 port 49006 [preauth]
Sep  9 14:01:37 nativespace-cdp sshd[4015433]: Connection closed by 159.100.136.21 port 58362 [preauth]
Sep  9 14:06:34 nativespace-cdp sshd[4016683]: Connection closed by 159.100.136.21 port 38524 [preauth]
Sep  9 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:40 nativespace-cdp sudo[4017273]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:40 nativespace-cdp sudo[4017277]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:41 nativespace-cdp sudo[4017282]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:41 nativespace-cdp sudo[4017290]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:45 nativespace-cdp sudo[4017296]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:45 nativespace-cdp sudo[4017316]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:45 nativespace-cdp sudo[4017321]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:45 nativespace-cdp sudo[4017325]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:45 nativespace-cdp sudo[4017330]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:45 nativespace-cdp sudo[4017336]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 14:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:45 nativespace-cdp sudo[4017342]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:47 nativespace-cdp sudo[4017352]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 14:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:48 nativespace-cdp sudo[4017366]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=hodgesonweb user-3=theblack user-4=spectrum user-5=agproduc user-6=still user-7=leereyn1 user-8=stephani user-9=foundation user-10=markward user-11=booff user-12=lbscrmod user-13=maflemin user-14=vantagep user-15=connect9 user-16=athenare user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=hhdugcor user-22=lbhyisi user-23=magichat user-24=lakesan1 user-25=brmrjxl user-26=atestord user-27=sarafoundation user-28=strathar user-29=wilsonsw user-30=megacards user-31=musorguk user-32=elecleis user-33=gilpin user-34=milloyco user-35=fetch user-36=carsinyo user-37=putterfi user-38=hubmaster user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=ultbcrra user-45=jonhartl user-46=seftvta user-47=opaiscyx
Sep  9 14:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=coursemc user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=highlegh user-53=southlon user-54=firstred user-55=alexadmin user-56=skyfirec user-57=stuartge user-58=askhform user-59=innovat1 user-60=nativene user-61=nstriton user-62=brighto1 user-63=oneoarco user-64=battlere user-65=vivienn1 user-66=firstre2 user-67=bedfords user-68=bemadonn user-69=newstoda user-70=belle user-71=ggaaorgu user-72=fawcettd user-73=burydropin user-74=nsceres user-75=darkstar user-76=eatspam user-77=beauty user-78=dhyana user-79=sibtoncc user-80=asandcoc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=ninejimm user-85=reliable user-86=cambria1 user-87=cathski user-88=cwsocial user-89=howardon user-90=pugwash user-91=paulmca1 user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=foods user-96=leftie user-97=health2045 user-98=fortunaz user-99=nscdp user-100=putterfc user-101=firstre5
Sep  9 14:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=donnychicago user-103=steakbridieme user-104=ctedorgu user-105=philmcph user-106=lkpier user-107=smrszyqg user-108=isleofwi user-109=barbersh user-110=tigerlet user-111=nomistakes user-112=hidden user-113=lucy user-114=attlebor user-115=onlycont user-116=branko user-117=outdoorc user-118=hodgsonmail user-119=ranxterc user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=david user-126=careers user-127=nbhavers user-128=what user-129=oubpgvbx user-130=tstardom user-131=nvihkvu user-132=havantho user-133=sketchy user-134=cath user-135=kategilpin user-136=dancinggardener user-137=stagingerris user-138=ladburyp user-139=design user-140=nove user-141=boldover user-142=crrtipdl user-143=sosevalu user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 14:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 14:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:49 nativespace-cdp sudo[4017373]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:49 nativespace-cdp sudo[4017382]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-q07fUfgo7fwtf0dQ.~
Sep  9 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:49 nativespace-cdp sudo[4017388]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-q07fUfgo7fwtf0dQ.~'
Sep  9 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:49 nativespace-cdp sudo[4017392]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-q07fUfgo7fwtf0dQ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:49 nativespace-cdp sudo[4017398]: pam_unix(sudo:session): session closed for user root
Sep  9 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:09:49 nativespace-cdp sudo[4017403]: pam_unix(sudo:session): session closed for user root
Sep  9 14:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 14:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 14:10:07 nativespace-cdp sudo[4017634]: pam_unix(sudo:session): session closed for user root
Sep  9 14:11:33 nativespace-cdp sshd[4018036]: Connection closed by 159.100.136.21 port 47508 [preauth]
Sep  9 14:16:35 nativespace-cdp sshd[4019391]: Connection closed by 159.100.136.21 port 56496 [preauth]
Sep  9 14:21:33 nativespace-cdp sshd[4020548]: Connection closed by 159.100.136.21 port 37086 [preauth]
Sep  9 14:26:33 nativespace-cdp sshd[4021819]: Connection closed by 159.100.136.21 port 46840 [preauth]
Sep  9 14:31:33 nativespace-cdp sshd[4023081]: Connection closed by 159.100.136.21 port 55242 [preauth]
Sep  9 14:36:34 nativespace-cdp sshd[4024189]: Connection closed by 159.100.136.21 port 36254 [preauth]
Sep  9 14:41:33 nativespace-cdp sshd[4025407]: Connection closed by 159.100.136.21 port 45520 [preauth]
Sep  9 14:46:33 nativespace-cdp sshd[4026895]: Connection closed by 159.100.136.21 port 54172 [preauth]
Sep  9 14:51:33 nativespace-cdp sshd[4028220]: Connection closed by 159.100.136.21 port 35370 [preauth]
Sep  9 14:56:36 nativespace-cdp sshd[4029752]: Connection closed by 159.100.136.21 port 45304 [preauth]
Sep  9 15:01:33 nativespace-cdp sshd[4030887]: Connection closed by 159.100.136.21 port 54580 [preauth]
Sep  9 15:06:35 nativespace-cdp sshd[4032041]: Connection closed by 159.100.136.21 port 36136 [preauth]
Sep  9 15:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 15:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:40 nativespace-cdp sudo[4032697]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:41 nativespace-cdp sudo[4032701]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:42 nativespace-cdp sudo[4032707]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 15:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:42 nativespace-cdp sudo[4032717]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 15:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:45 nativespace-cdp sudo[4032723]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 15:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:45 nativespace-cdp sudo[4032739]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:46 nativespace-cdp sudo[4032744]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:46 nativespace-cdp sudo[4032748]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:46 nativespace-cdp sudo[4032753]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:46 nativespace-cdp sudo[4032759]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:46 nativespace-cdp sudo[4032764]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 15:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:51 nativespace-cdp sudo[4032788]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 15:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:52 nativespace-cdp sudo[4032797]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=booff user-2=markward user-3=foundation user-4=connect9 user-5=athenare user-6=vantagep user-7=maflemin user-8=lbscrmod user-9=ulsukarm user-10=jarvisin user-11=spectrum user-12=theblack user-13=hodgesonweb user-14=still user-15=agproduc user-16=stephani user-17=leereyn1 user-18=lakesan1 user-19=brmrjxl user-20=strathar user-21=sarafoundation user-22=atestord user-23=wilsonsw user-24=musorguk user-25=megacards user-26=martsblo user-27=dickemery123 user-28=ptkxhsbt user-29=lbhyisi user-30=hhdugcor user-31=magichat user-32=jonhartl user-33=seftvta user-34=ultbcrra user-35=firstres user-36=opaiscyx user-37=coursemc user-38=firstrel user-39=clarkass user-40=costestimatorco user-41=firstred user-42=southlon user-43=highlegh user-44=gilpin user-45=milloyco user-46=elecleis user-47=putterfi
Sep  9 15:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=hubmaster user-49=carsinyo user-50=fetch user-51=accooper user-52=ianrayne user-53=connectedshoppin user-54=thqkgnbz user-55=brighto1 user-56=nstriton user-57=firstre2 user-58=vivienn1 user-59=battlere user-60=oneoarco user-61=bedfords user-62=ggaaorgu user-63=belle user-64=newstoda user-65=bemadonn user-66=alexadmin user-67=skyfirec user-68=innovat1 user-69=stuartge user-70=askhform user-71=nativene user-72=sibtoncc user-73=asandcoc user-74=bwppodcast user-75=zebrapho user-76=steve user-77=burydropin user-78=fawcettd user-79=nsceres user-80=beauty user-81=eatspam user-82=darkstar user-83=dhyana user-84=putterfc user-85=nscdp user-86=health2045 user-87=fortunaz user-88=foods user-89=leftie user-90=lkpier user-91=philmcph user-92=ctedorgu user-93=donnychicago user-94=steakbridieme user-95=firstre5 user-96=isleofwi user-97=smrszyqg user-98=hidden user-99=nomistakes user-100=tigerlet user-101=barbersh
Sep  9 15:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=cathski user-103=cambria1 user-104=ninejimm user-105=reliable user-106=howardon user-107=pugwash user-108=paulmca1 user-109=cwsocial user-110=hirefootballgame user-111=eugincou user-112=courseme user-113=tomandle user-114=jennimil user-115=chrisdal user-116=mcdermos user-117=careers user-118=nbhavers user-119=david user-120=attlebor user-121=lucy user-122=onlycont user-123=hodgsonmail user-124=outdoorc user-125=ranxterc user-126=branko user-127=romaldki user-128=nove user-129=boldover user-130=bakery user-131=sosevalu user-132=crrtipdl user-133=tstardom user-134=oubpgvbx user-135=what user-136=cath user-137=sketchy user-138=havantho user-139=nvihkvu user-140=ladburyp user-141=stagingerris user-142=dancinggardener user-143=kategilpin user-144=design feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 15:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 15:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:53 nativespace-cdp sudo[4032807]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 15:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:54 nativespace-cdp sudo[4032818]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-G97EEJOIFZgOAw8O.~
Sep  9 15:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:54 nativespace-cdp sudo[4032823]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-G97EEJOIFZgOAw8O.~'
Sep  9 15:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:54 nativespace-cdp sudo[4032827]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-G97EEJOIFZgOAw8O.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 15:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:54 nativespace-cdp sudo[4032833]: pam_unix(sudo:session): session closed for user root
Sep  9 15:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 15:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:09:54 nativespace-cdp sudo[4032838]: pam_unix(sudo:session): session closed for user root
Sep  9 15:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 15:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 15:10:07 nativespace-cdp sudo[4033008]: pam_unix(sudo:session): session closed for user root
Sep  9 15:11:36 nativespace-cdp sshd[4033428]: Connection closed by 159.100.136.21 port 45132 [preauth]
Sep  9 15:16:33 nativespace-cdp sshd[4034965]: Connection closed by 159.100.136.21 port 53546 [preauth]
Sep  9 15:21:34 nativespace-cdp sshd[4036169]: Connection closed by 159.100.136.21 port 34642 [preauth]
Sep  9 15:26:33 nativespace-cdp sshd[4037257]: Connection closed by 159.100.136.21 port 43970 [preauth]
Sep  9 15:31:36 nativespace-cdp sshd[4038716]: Connection closed by 159.100.136.21 port 53128 [preauth]
Sep  9 15:36:33 nativespace-cdp sshd[4039762]: Connection closed by 159.100.136.21 port 34872 [preauth]
Sep  9 15:41:36 nativespace-cdp sshd[4041007]: Connection closed by 159.100.136.21 port 44010 [preauth]
Sep  9 15:46:33 nativespace-cdp sshd[4042478]: Connection closed by 159.100.136.21 port 52200 [preauth]
Sep  9 15:51:33 nativespace-cdp sshd[4043653]: Connection closed by 159.100.136.21 port 33018 [preauth]
Sep  9 15:56:33 nativespace-cdp sshd[4044919]: Connection closed by 159.100.136.21 port 42760 [preauth]
Sep  9 16:01:35 nativespace-cdp sshd[4046532]: Connection closed by 159.100.136.21 port 51798 [preauth]
Sep  9 16:06:33 nativespace-cdp sshd[4047882]: Connection closed by 159.100.136.21 port 33376 [preauth]
Sep  9 16:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 16:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:34 nativespace-cdp sudo[4048526]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 16:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:35 nativespace-cdp sudo[4048530]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 16:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:35 nativespace-cdp sudo[4048535]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 16:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:35 nativespace-cdp sudo[4048542]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 16:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:38 nativespace-cdp sudo[4048548]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:38 nativespace-cdp sudo[4048624]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:38 nativespace-cdp sudo[4048633]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:38 nativespace-cdp sudo[4048638]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:38 nativespace-cdp sudo[4048643]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:38 nativespace-cdp sudo[4048649]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:38 nativespace-cdp sudo[4048655]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 16:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:40 nativespace-cdp sudo[4048699]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 16:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:40 nativespace-cdp sudo[4048706]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bwppodcast user-2=zebrapho user-3=steve user-4=sibtoncc user-5=asandcoc user-6=beauty user-7=eatspam user-8=darkstar user-9=dhyana user-10=burydropin user-11=fawcettd user-12=nsceres user-13=isleofwi user-14=smrszyqg user-15=hidden user-16=nomistakes user-17=barbersh user-18=tigerlet user-19=putterfc user-20=nscdp user-21=fortunaz user-22=health2045 user-23=foods user-24=leftie user-25=lkpier user-26=ctedorgu user-27=philmcph user-28=firstre5 user-29=steakbridieme user-30=donnychicago user-31=hirefootballgame user-32=eugincou user-33=courseme user-34=cambria1 user-35=cathski user-36=ninejimm user-37=reliable user-38=howardon user-39=paulmca1 user-40=pugwash user-41=cwsocial user-42=chrisdal user-43=mcdermos user-44=careers user-45=nbhavers user-46=david user-47=tomandle user-48=jennimil
Sep  9 16:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=outdoorc user-50=hodgsonmail user-51=ranxterc user-52=branko user-53=romaldki user-54=attlebor user-55=lucy user-56=onlycont user-57=bakery user-58=sosevalu user-59=crrtipdl user-60=nove user-61=boldover user-62=ladburyp user-63=stagingerris user-64=dancinggardener user-65=kategilpin user-66=design user-67=oubpgvbx user-68=tstardom user-69=what user-70=cath user-71=sketchy user-72=havantho user-73=nvihkvu user-74=ulsukarm user-75=booff user-76=markward user-77=foundation user-78=athenare user-79=connect9 user-80=vantagep user-81=maflemin user-82=lbscrmod user-83=still user-84=agproduc user-85=stephani user-86=leereyn1 user-87=jarvisin user-88=spectrum user-89=hodgesonweb user-90=theblack user-91=wilsonsw user-92=musorguk user-93=megacards user-94=brmrjxl user-95=lakesan1 user-96=strathar user-97=sarafoundation user-98=atestord user-99=lbhyisi user-100=hhdugcor user-101=magichat user-102=martsblo
Sep  9 16:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=dickemery123 user-104=ptkxhsbt user-105=clarkass user-106=firstrel user-107=costestimatorco user-108=firstred user-109=southlon user-110=highlegh user-111=jonhartl user-112=seftvta user-113=ultbcrra user-114=firstres user-115=opaiscyx user-116=coursemc user-117=accooper user-118=ianrayne user-119=connectedshoppin user-120=thqkgnbz user-121=gilpin user-122=milloyco user-123=elecleis user-124=hubmaster user-125=putterfi user-126=carsinyo user-127=fetch user-128=bedfords user-129=ggaaorgu user-130=belle user-131=newstoda user-132=bemadonn user-133=brighto1 user-134=nstriton user-135=firstre2 user-136=vivienn1 user-137=battlere user-138=oneoarco user-139=innovat1 user-140=askhform user-141=stuartge user-142=nativene user-143=skyfirec user-144=alexadmin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 16:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 16:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:41 nativespace-cdp sudo[4048713]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 16:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:41 nativespace-cdp sudo[4048722]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-v2x2L4svbmkXGfD4.~
Sep  9 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:42 nativespace-cdp sudo[4048728]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-v2x2L4svbmkXGfD4.~'
Sep  9 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:42 nativespace-cdp sudo[4048732]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-v2x2L4svbmkXGfD4.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:42 nativespace-cdp sudo[4048738]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 16:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:42 nativespace-cdp sudo[4048743]: pam_unix(sudo:session): session closed for user root
Sep  9 16:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 16:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 16:09:43 nativespace-cdp sudo[4048765]: pam_unix(sudo:session): session closed for user root
Sep  9 16:11:33 nativespace-cdp sshd[4049378]: Connection closed by 159.100.136.21 port 42720 [preauth]
Sep  9 16:16:33 nativespace-cdp sshd[4050646]: Connection closed by 159.100.136.21 port 51926 [preauth]
Sep  9 16:21:34 nativespace-cdp sshd[4052165]: Connection closed by 159.100.136.21 port 33022 [preauth]
Sep  9 16:26:33 nativespace-cdp sshd[4053463]: Connection closed by 159.100.136.21 port 42764 [preauth]
Sep  9 16:31:33 nativespace-cdp sshd[4055124]: Connection closed by 159.100.136.21 port 51854 [preauth]
Sep  9 16:36:34 nativespace-cdp sshd[4056382]: Connection closed by 159.100.136.21 port 60732 [preauth]
Sep  9 16:41:33 nativespace-cdp sshd[4057982]: Connection closed by 159.100.136.21 port 41574 [preauth]
Sep  9 16:46:33 nativespace-cdp sshd[4059406]: Connection closed by 159.100.136.21 port 50778 [preauth]
Sep  9 16:51:35 nativespace-cdp sshd[4060829]: Connection closed by 159.100.136.21 port 59802 [preauth]
Sep  9 16:56:33 nativespace-cdp sshd[4062313]: Connection closed by 159.100.136.21 port 41058 [preauth]
Sep  9 16:59:53 nativespace-cdp sshd[4063059]: Invalid user mk from 92.222.181.145 port 34436
Sep  9 16:59:53 nativespace-cdp sshd[4063059]: input_userauth_request: invalid user mk [preauth]
Sep  9 16:59:53 nativespace-cdp sshd[4063059]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 16:59:53 nativespace-cdp sshd[4063059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.181.145
Sep  9 16:59:55 nativespace-cdp sshd[4063059]: Failed password for invalid user mk from 92.222.181.145 port 34436 ssh2
Sep  9 16:59:55 nativespace-cdp sshd[4063059]: Received disconnect from 92.222.181.145 port 34436:11: Bye Bye [preauth]
Sep  9 16:59:55 nativespace-cdp sshd[4063059]: Disconnected from 92.222.181.145 port 34436 [preauth]
Sep  9 17:01:33 nativespace-cdp sshd[4063663]: Connection closed by 159.100.136.21 port 50284 [preauth]
Sep  9 17:01:37 nativespace-cdp sshd[4063728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.199.95.142  user=root
Sep  9 17:01:37 nativespace-cdp sshd[4063728]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 17:01:39 nativespace-cdp sshd[4063728]: Failed password for root from 35.199.95.142 port 53238 ssh2
Sep  9 17:01:41 nativespace-cdp sshd[4063728]: Received disconnect from 35.199.95.142 port 53238:11: Bye Bye [preauth]
Sep  9 17:01:41 nativespace-cdp sshd[4063728]: Disconnected from 35.199.95.142 port 53238 [preauth]
Sep  9 17:05:39 nativespace-cdp sshd[4064879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.119.107  user=root
Sep  9 17:05:39 nativespace-cdp sshd[4064879]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 17:05:41 nativespace-cdp sshd[4064879]: Failed password for root from 146.190.119.107 port 51422 ssh2
Sep  9 17:05:47 nativespace-cdp sshd[4064879]: Received disconnect from 146.190.119.107 port 51422:11: Bye Bye [preauth]
Sep  9 17:05:47 nativespace-cdp sshd[4064879]: Disconnected from 146.190.119.107 port 51422 [preauth]
Sep  9 17:06:33 nativespace-cdp sshd[4065055]: Connection closed by 159.100.136.21 port 60040 [preauth]
Sep  9 17:06:56 nativespace-cdp sshd[4065126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.199.95.142  user=root
Sep  9 17:06:56 nativespace-cdp sshd[4065126]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 17:06:58 nativespace-cdp sshd[4065126]: Failed password for root from 35.199.95.142 port 39646 ssh2
Sep  9 17:07:00 nativespace-cdp sshd[4065126]: Received disconnect from 35.199.95.142 port 39646:11: Bye Bye [preauth]
Sep  9 17:07:00 nativespace-cdp sshd[4065126]: Disconnected from 35.199.95.142 port 39646 [preauth]
Sep  9 17:07:16 nativespace-cdp sshd[4065195]: Invalid user mk from 107.173.241.162 port 59448
Sep  9 17:07:16 nativespace-cdp sshd[4065195]: input_userauth_request: invalid user mk [preauth]
Sep  9 17:07:16 nativespace-cdp sshd[4065195]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 17:07:16 nativespace-cdp sshd[4065195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.173.241.162
Sep  9 17:07:18 nativespace-cdp sshd[4065195]: Failed password for invalid user mk from 107.173.241.162 port 59448 ssh2
Sep  9 17:07:19 nativespace-cdp sshd[4065195]: Received disconnect from 107.173.241.162 port 59448:11: Bye Bye [preauth]
Sep  9 17:07:19 nativespace-cdp sshd[4065195]: Disconnected from 107.173.241.162 port 59448 [preauth]
Sep  9 17:07:47 nativespace-cdp sshd[4065349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.181.145  user=root
Sep  9 17:07:47 nativespace-cdp sshd[4065349]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 17:07:49 nativespace-cdp sshd[4065349]: Failed password for root from 92.222.181.145 port 33814 ssh2
Sep  9 17:07:50 nativespace-cdp sshd[4065349]: Received disconnect from 92.222.181.145 port 33814:11: Bye Bye [preauth]
Sep  9 17:07:50 nativespace-cdp sshd[4065349]: Disconnected from 92.222.181.145 port 33814 [preauth]
Sep  9 17:07:51 nativespace-cdp sshd[4065359]: Invalid user college from 146.190.119.107 port 41066
Sep  9 17:07:51 nativespace-cdp sshd[4065359]: input_userauth_request: invalid user college [preauth]
Sep  9 17:07:51 nativespace-cdp sshd[4065359]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 17:07:51 nativespace-cdp sshd[4065359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.119.107
Sep  9 17:07:51 nativespace-cdp sshd[4065354]: Invalid user puppyrhaod from 35.199.95.142 port 54982
Sep  9 17:07:51 nativespace-cdp sshd[4065354]: input_userauth_request: invalid user puppyrhaod [preauth]
Sep  9 17:07:51 nativespace-cdp sshd[4065354]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 17:07:51 nativespace-cdp sshd[4065354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.199.95.142
Sep  9 17:07:53 nativespace-cdp sshd[4065359]: Failed password for invalid user college from 146.190.119.107 port 41066 ssh2
Sep  9 17:07:53 nativespace-cdp sshd[4065354]: Failed password for invalid user puppyrhaod from 35.199.95.142 port 54982 ssh2
Sep  9 17:07:53 nativespace-cdp sshd[4065359]: Received disconnect from 146.190.119.107 port 41066:11: Bye Bye [preauth]
Sep  9 17:07:53 nativespace-cdp sshd[4065359]: Disconnected from 146.190.119.107 port 41066 [preauth]
Sep  9 17:07:53 nativespace-cdp sshd[4065354]: Received disconnect from 35.199.95.142 port 54982:11: Bye Bye [preauth]
Sep  9 17:07:53 nativespace-cdp sshd[4065354]: Disconnected from 35.199.95.142 port 54982 [preauth]
Sep  9 17:08:30 nativespace-cdp sshd[4065509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.181.145  user=root
Sep  9 17:08:30 nativespace-cdp sshd[4065509]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 17:08:32 nativespace-cdp sshd[4065509]: Failed password for root from 92.222.181.145 port 33644 ssh2
Sep  9 17:08:32 nativespace-cdp sshd[4065509]: Received disconnect from 92.222.181.145 port 33644:11: Bye Bye [preauth]
Sep  9 17:08:32 nativespace-cdp sshd[4065509]: Disconnected from 92.222.181.145 port 33644 [preauth]
Sep  9 17:08:34 nativespace-cdp sshd[4065518]: Invalid user oscommerce from 146.190.119.107 port 43078
Sep  9 17:08:34 nativespace-cdp sshd[4065518]: input_userauth_request: invalid user oscommerce [preauth]
Sep  9 17:08:34 nativespace-cdp sshd[4065518]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 17:08:34 nativespace-cdp sshd[4065518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.119.107
Sep  9 17:08:36 nativespace-cdp sshd[4065518]: Failed password for invalid user oscommerce from 146.190.119.107 port 43078 ssh2
Sep  9 17:08:39 nativespace-cdp sshd[4065518]: Received disconnect from 146.190.119.107 port 43078:11: Bye Bye [preauth]
Sep  9 17:08:39 nativespace-cdp sshd[4065518]: Disconnected from 146.190.119.107 port 43078 [preauth]
Sep  9 17:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 17:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:40 nativespace-cdp sudo[4065840]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 17:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:41 nativespace-cdp sudo[4065844]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 17:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:43 nativespace-cdp sudo[4065849]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 17:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:43 nativespace-cdp sudo[4065875]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 17:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:47 nativespace-cdp sudo[4065881]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 17:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:47 nativespace-cdp sudo[4065911]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 17:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:47 nativespace-cdp sudo[4065916]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 17:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:47 nativespace-cdp sudo[4065920]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 17:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:47 nativespace-cdp sudo[4065925]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 17:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:47 nativespace-cdp sudo[4065931]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 17:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:48 nativespace-cdp sudo[4065936]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 17:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:55 nativespace-cdp sudo[4065962]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 17:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:57 nativespace-cdp sudo[4065970]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=strathar user-2=atestord user-3=sarafoundation user-4=brmrjxl user-5=lakesan1 user-6=megacards user-7=musorguk user-8=wilsonsw user-9=dickemery123 user-10=ptkxhsbt user-11=martsblo user-12=magichat user-13=hhdugcor user-14=lbhyisi user-15=vantagep user-16=connect9 user-17=athenare user-18=lbscrmod user-19=maflemin user-20=markward user-21=booff user-22=foundation user-23=ulsukarm user-24=spectrum user-25=theblack user-26=hodgesonweb user-27=jarvisin user-28=stephani user-29=leereyn1 user-30=agproduc user-31=still user-32=vivienn1 user-33=firstre2 user-34=oneoarco user-35=battlere user-36=nstriton user-37=brighto1 user-38=newstoda user-39=ggaaorgu user-40=belle user-41=bemadonn user-42=bedfords user-43=skyfirec user-44=alexadmin user-45=nativene user-46=innovat1 user-47=stuartge user-48=askhform
Sep  9 17:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=coursemc user-50=opaiscyx user-51=ultbcrra user-52=jonhartl user-53=seftvta user-54=firstres user-55=firstred user-56=highlegh user-57=southlon user-58=firstrel user-59=clarkass user-60=costestimatorco user-61=hubmaster user-62=putterfi user-63=fetch user-64=carsinyo user-65=gilpin user-66=milloyco user-67=elecleis user-68=connectedshoppin user-69=thqkgnbz user-70=accooper user-71=ianrayne user-72=lkpier user-73=steakbridieme user-74=donnychicago user-75=firstre5 user-76=ctedorgu user-77=philmcph user-78=nscdp user-79=putterfc user-80=leftie user-81=foods user-82=health2045 user-83=fortunaz user-84=nomistakes user-85=hidden user-86=barbersh user-87=tigerlet user-88=smrszyqg user-89=isleofwi user-90=cwsocial user-91=paulmca1 user-92=pugwash user-93=howardon user-94=cambria1 user-95=cathski user-96=reliable user-97=ninejimm user-98=eugincou user-99=courseme user-100=hirefootballgame user-101=asandcoc
Sep  9 17:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sibtoncc user-103=steve user-104=bwppodcast user-105=zebrapho user-106=nsceres user-107=fawcettd user-108=burydropin user-109=dhyana user-110=beauty user-111=darkstar user-112=eatspam user-113=boldover user-114=nove user-115=bakery user-116=crrtipdl user-117=sosevalu user-118=havantho user-119=sketchy user-120=cath user-121=nvihkvu user-122=oubpgvbx user-123=tstardom user-124=what user-125=design user-126=stagingerris user-127=dancinggardener user-128=ladburyp user-129=kategilpin user-130=jennimil user-131=tomandle user-132=david user-133=nbhavers user-134=careers user-135=chrisdal user-136=mcdermos user-137=onlycont user-138=lucy user-139=attlebor user-140=romaldki user-141=ranxterc user-142=outdoorc user-143=hodgsonmail user-144=branko feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 17:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 17:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:58 nativespace-cdp sudo[4065979]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 17:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:58 nativespace-cdp sudo[4065986]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-o1W8bTzqNIKNxI4A.~
Sep  9 17:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:59 nativespace-cdp sudo[4065991]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-o1W8bTzqNIKNxI4A.~'
Sep  9 17:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:59 nativespace-cdp sudo[4065996]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-o1W8bTzqNIKNxI4A.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 17:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:59 nativespace-cdp sudo[4066002]: pam_unix(sudo:session): session closed for user root
Sep  9 17:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 17:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:09:59 nativespace-cdp sudo[4066007]: pam_unix(sudo:session): session closed for user root
Sep  9 17:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 17:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 17:10:07 nativespace-cdp sudo[4066165]: pam_unix(sudo:session): session closed for user root
Sep  9 17:11:34 nativespace-cdp sshd[4066552]: Connection closed by 159.100.136.21 port 41296 [preauth]
Sep  9 17:12:48 nativespace-cdp sshd[4066814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.173.241.162  user=root
Sep  9 17:12:48 nativespace-cdp sshd[4066814]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 17:12:51 nativespace-cdp sshd[4066814]: Failed password for root from 107.173.241.162 port 44300 ssh2
Sep  9 17:12:51 nativespace-cdp sshd[4066814]: Received disconnect from 107.173.241.162 port 44300:11: Bye Bye [preauth]
Sep  9 17:12:51 nativespace-cdp sshd[4066814]: Disconnected from 107.173.241.162 port 44300 [preauth]
Sep  9 17:13:42 nativespace-cdp sshd[4066962]: Invalid user bkim from 107.173.241.162 port 57476
Sep  9 17:13:42 nativespace-cdp sshd[4066962]: input_userauth_request: invalid user bkim [preauth]
Sep  9 17:13:42 nativespace-cdp sshd[4066962]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 17:13:42 nativespace-cdp sshd[4066962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.173.241.162
Sep  9 17:13:44 nativespace-cdp sshd[4066962]: Failed password for invalid user bkim from 107.173.241.162 port 57476 ssh2
Sep  9 17:13:46 nativespace-cdp sshd[4066962]: Received disconnect from 107.173.241.162 port 57476:11: Bye Bye [preauth]
Sep  9 17:13:46 nativespace-cdp sshd[4066962]: Disconnected from 107.173.241.162 port 57476 [preauth]
Sep  9 17:16:35 nativespace-cdp sshd[4067691]: Connection closed by 159.100.136.21 port 50536 [preauth]
Sep  9 17:21:36 nativespace-cdp sshd[4069145]: Connection closed by 159.100.136.21 port 59416 [preauth]
Sep  9 17:26:33 nativespace-cdp sshd[4070625]: Connection closed by 159.100.136.21 port 39698 [preauth]
Sep  9 17:31:35 nativespace-cdp sshd[4072236]: Connection closed by 159.100.136.21 port 47408 [preauth]
Sep  9 17:41:34 nativespace-cdp sshd[4074495]: Connection closed by 159.100.136.21 port 37682 [preauth]
Sep  9 17:46:34 nativespace-cdp sshd[4076074]: Connection closed by 159.100.136.21 port 47268 [preauth]
Sep  9 17:51:35 nativespace-cdp sshd[4077469]: Connection closed by 159.100.136.21 port 56718 [preauth]
Sep  9 17:56:36 nativespace-cdp sshd[4078902]: Connection closed by 159.100.136.21 port 38178 [preauth]
Sep  9 18:01:33 nativespace-cdp sshd[4080039]: Connection closed by 159.100.136.21 port 46246 [preauth]
Sep  9 18:06:34 nativespace-cdp sshd[4081111]: Connection closed by 159.100.136.21 port 55936 [preauth]
Sep  9 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:39 nativespace-cdp sudo[4081636]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 18:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:39 nativespace-cdp sudo[4081640]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 18:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:41 nativespace-cdp sudo[4081645]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:41 nativespace-cdp sudo[4081653]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 18:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:45 nativespace-cdp sudo[4081659]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:45 nativespace-cdp sudo[4081685]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:45 nativespace-cdp sudo[4081690]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:45 nativespace-cdp sudo[4081694]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:45 nativespace-cdp sudo[4081699]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:45 nativespace-cdp sudo[4081705]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 18:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:45 nativespace-cdp sudo[4081710]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 18:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:57 nativespace-cdp sudo[4081806]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 18:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:58 nativespace-cdp sudo[4081812]: pam_unix(sudo:session): session closed for user root
Sep  9 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=design user-2=ladburyp user-3=stagingerris user-4=dancinggardener user-5=kategilpin user-6=sketchy user-7=cath user-8=havantho user-9=nvihkvu user-10=tstardom user-11=oubpgvbx user-12=what user-13=bakery user-14=sosevalu user-15=crrtipdl user-16=boldover user-17=nove user-18=romaldki user-19=hodgsonmail user-20=outdoorc user-21=ranxterc user-22=branko user-23=onlycont user-24=attlebor user-25=lucy user-26=nbhavers user-27=careers user-28=david user-29=chrisdal user-30=mcdermos user-31=jennimil user-32=tomandle user-33=eugincou user-34=courseme user-35=hirefootballgame user-36=paulmca1 user-37=howardon user-38=pugwash user-39=cwsocial user-40=cathski user-41=cambria1 user-42=reliable user-43=ninejimm user-44=hidden user-45=nomistakes user-46=barbersh user-47=tigerlet user-48=isleofwi
Sep  9 18:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=smrszyqg user-50=lkpier user-51=ctedorgu user-52=philmcph user-53=firstre5 user-54=donnychicago user-55=steakbridieme user-56=putterfc user-57=nscdp user-58=health2045 user-59=fortunaz user-60=foods user-61=leftie user-62=dhyana user-63=beauty user-64=eatspam user-65=darkstar user-66=nsceres user-67=burydropin user-68=fawcettd user-69=steve user-70=bwppodcast user-71=zebrapho user-72=asandcoc user-73=sibtoncc user-74=nativene user-75=innovat1 user-76=stuartge user-77=askhform user-78=alexadmin user-79=skyfirec user-80=belle user-81=ggaaorgu user-82=newstoda user-83=bemadonn user-84=bedfords user-85=firstre2 user-86=vivienn1 user-87=battlere user-88=oneoarco user-89=brighto1 user-90=nstriton user-91=connectedshoppin user-92=thqkgnbz user-93=accooper user-94=ianrayne user-95=putterfi user-96=hubmaster user-97=carsinyo user-98=fetch user-99=milloyco user-100=gilpin user-101=elecleis user-102=firstred
Sep  9 18:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=southlon user-104=highlegh user-105=clarkass user-106=firstrel user-107=costestimatorco user-108=opaiscyx user-109=coursemc user-110=jonhartl user-111=seftvta user-112=ultbcrra user-113=firstres user-114=magichat user-115=lbhyisi user-116=hhdugcor user-117=dickemery123 user-118=ptkxhsbt user-119=martsblo user-120=musorguk user-121=megacards user-122=wilsonsw user-123=strathar user-124=sarafoundation user-125=atestord user-126=brmrjxl user-127=lakesan1 user-128=stephani user-129=leereyn1 user-130=still user-131=agproduc user-132=spectrum user-133=theblack user-134=hodgesonweb user-135=jarvisin user-136=ulsukarm user-137=athenare user-138=connect9 user-139=vantagep user-140=maflemin user-141=lbscrmod user-142=markward user-143=booff user-144=foundation feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 18:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:09:59 nativespace-cdp sudo[4081820]: pam_unix(sudo:session): session closed for user root
Sep  9 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:10:00 nativespace-cdp sudo[4081829]: pam_unix(sudo:session): session closed for user root
Sep  9 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rt1aemfYhiKJtiMr.~
Sep  9 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:10:00 nativespace-cdp sudo[4081834]: pam_unix(sudo:session): session closed for user root
Sep  9 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rt1aemfYhiKJtiMr.~'
Sep  9 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:10:00 nativespace-cdp sudo[4081838]: pam_unix(sudo:session): session closed for user root
Sep  9 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rt1aemfYhiKJtiMr.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:10:00 nativespace-cdp sudo[4081845]: pam_unix(sudo:session): session closed for user root
Sep  9 18:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 18:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:10:00 nativespace-cdp sudo[4081850]: pam_unix(sudo:session): session closed for user root
Sep  9 18:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 18:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 18:10:07 nativespace-cdp sudo[4081999]: pam_unix(sudo:session): session closed for user root
Sep  9 18:11:33 nativespace-cdp sshd[4082424]: Connection closed by 159.100.136.21 port 36652 [preauth]
Sep  9 18:16:33 nativespace-cdp sshd[4083869]: Connection closed by 159.100.136.21 port 46136 [preauth]
Sep  9 18:20:55 nativespace-cdp sshd[4084863]: Invalid user eprints from 79.45.20.53 port 50793
Sep  9 18:20:55 nativespace-cdp sshd[4084863]: input_userauth_request: invalid user eprints [preauth]
Sep  9 18:20:55 nativespace-cdp sshd[4084863]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:20:55 nativespace-cdp sshd[4084863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.45.20.53
Sep  9 18:20:57 nativespace-cdp sshd[4084863]: Failed password for invalid user eprints from 79.45.20.53 port 50793 ssh2
Sep  9 18:20:57 nativespace-cdp sshd[4084863]: Received disconnect from 79.45.20.53 port 50793:11: Bye Bye [preauth]
Sep  9 18:20:57 nativespace-cdp sshd[4084863]: Disconnected from 79.45.20.53 port 50793 [preauth]
Sep  9 18:21:33 nativespace-cdp sshd[4085028]: Connection closed by 159.100.136.21 port 55232 [preauth]
Sep  9 18:22:08 nativespace-cdp sshd[4085215]: Invalid user testuser from 134.209.108.169 port 56514
Sep  9 18:22:08 nativespace-cdp sshd[4085215]: input_userauth_request: invalid user testuser [preauth]
Sep  9 18:22:08 nativespace-cdp sshd[4085215]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:22:08 nativespace-cdp sshd[4085215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.169
Sep  9 18:22:11 nativespace-cdp sshd[4085215]: Failed password for invalid user testuser from 134.209.108.169 port 56514 ssh2
Sep  9 18:22:11 nativespace-cdp sshd[4085215]: Received disconnect from 134.209.108.169 port 56514:11: Bye Bye [preauth]
Sep  9 18:22:11 nativespace-cdp sshd[4085215]: Disconnected from 134.209.108.169 port 56514 [preauth]
Sep  9 18:25:02 nativespace-cdp sshd[4085878]: Invalid user osboxes from 51.195.138.37 port 45334
Sep  9 18:25:02 nativespace-cdp sshd[4085878]: input_userauth_request: invalid user osboxes [preauth]
Sep  9 18:25:02 nativespace-cdp sshd[4085878]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:25:02 nativespace-cdp sshd[4085878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.138.37
Sep  9 18:25:04 nativespace-cdp sshd[4085878]: Failed password for invalid user osboxes from 51.195.138.37 port 45334 ssh2
Sep  9 18:25:04 nativespace-cdp sshd[4085878]: Received disconnect from 51.195.138.37 port 45334:11: Bye Bye [preauth]
Sep  9 18:25:04 nativespace-cdp sshd[4085878]: Disconnected from 51.195.138.37 port 45334 [preauth]
Sep  9 18:26:33 nativespace-cdp sshd[4086320]: Connection closed by 159.100.136.21 port 36772 [preauth]
Sep  9 18:27:04 nativespace-cdp sshd[4086462]: Invalid user wms from 51.195.138.37 port 46184
Sep  9 18:27:04 nativespace-cdp sshd[4086462]: input_userauth_request: invalid user wms [preauth]
Sep  9 18:27:04 nativespace-cdp sshd[4086462]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:27:04 nativespace-cdp sshd[4086462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.138.37
Sep  9 18:27:06 nativespace-cdp sshd[4086462]: Failed password for invalid user wms from 51.195.138.37 port 46184 ssh2
Sep  9 18:27:06 nativespace-cdp sshd[4086462]: Received disconnect from 51.195.138.37 port 46184:11: Bye Bye [preauth]
Sep  9 18:27:06 nativespace-cdp sshd[4086462]: Disconnected from 51.195.138.37 port 46184 [preauth]
Sep  9 18:27:41 nativespace-cdp sshd[4086540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.45.20.53  user=root
Sep  9 18:27:41 nativespace-cdp sshd[4086540]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 18:27:43 nativespace-cdp sshd[4086540]: Failed password for root from 79.45.20.53 port 47863 ssh2
Sep  9 18:27:43 nativespace-cdp sshd[4086540]: Received disconnect from 79.45.20.53 port 47863:11: Bye Bye [preauth]
Sep  9 18:27:43 nativespace-cdp sshd[4086540]: Disconnected from 79.45.20.53 port 47863 [preauth]
Sep  9 18:27:45 nativespace-cdp sshd[4086564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.138.37  user=root
Sep  9 18:27:45 nativespace-cdp sshd[4086564]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 18:27:47 nativespace-cdp sshd[4086564]: Failed password for root from 51.195.138.37 port 45010 ssh2
Sep  9 18:27:47 nativespace-cdp sshd[4086564]: Received disconnect from 51.195.138.37 port 45010:11: Bye Bye [preauth]
Sep  9 18:27:47 nativespace-cdp sshd[4086564]: Disconnected from 51.195.138.37 port 45010 [preauth]
Sep  9 18:28:19 nativespace-cdp sshd[4086717]: Invalid user magento from 79.45.20.53 port 54580
Sep  9 18:28:19 nativespace-cdp sshd[4086717]: input_userauth_request: invalid user magento [preauth]
Sep  9 18:28:19 nativespace-cdp sshd[4086717]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:28:19 nativespace-cdp sshd[4086717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.45.20.53
Sep  9 18:28:21 nativespace-cdp sshd[4086717]: Failed password for invalid user magento from 79.45.20.53 port 54580 ssh2
Sep  9 18:28:23 nativespace-cdp sshd[4086717]: Received disconnect from 79.45.20.53 port 54580:11: Bye Bye [preauth]
Sep  9 18:28:23 nativespace-cdp sshd[4086717]: Disconnected from 79.45.20.53 port 54580 [preauth]
Sep  9 18:29:57 nativespace-cdp sshd[4087014]: Invalid user osboxes from 134.209.108.169 port 53322
Sep  9 18:29:57 nativespace-cdp sshd[4087014]: input_userauth_request: invalid user osboxes [preauth]
Sep  9 18:29:57 nativespace-cdp sshd[4087014]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:29:57 nativespace-cdp sshd[4087014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.169
Sep  9 18:29:59 nativespace-cdp sshd[4087014]: Failed password for invalid user osboxes from 134.209.108.169 port 53322 ssh2
Sep  9 18:30:02 nativespace-cdp sshd[4087014]: Received disconnect from 134.209.108.169 port 53322:11: Bye Bye [preauth]
Sep  9 18:30:02 nativespace-cdp sshd[4087014]: Disconnected from 134.209.108.169 port 53322 [preauth]
Sep  9 18:30:52 nativespace-cdp sshd[4087564]: Invalid user sdr from 134.209.108.169 port 51420
Sep  9 18:30:52 nativespace-cdp sshd[4087564]: input_userauth_request: invalid user sdr [preauth]
Sep  9 18:30:52 nativespace-cdp sshd[4087564]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:30:52 nativespace-cdp sshd[4087564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.169
Sep  9 18:30:53 nativespace-cdp sshd[4087564]: Failed password for invalid user sdr from 134.209.108.169 port 51420 ssh2
Sep  9 18:30:54 nativespace-cdp sshd[4087564]: Received disconnect from 134.209.108.169 port 51420:11: Bye Bye [preauth]
Sep  9 18:30:54 nativespace-cdp sshd[4087564]: Disconnected from 134.209.108.169 port 51420 [preauth]
Sep  9 18:31:33 nativespace-cdp sshd[4087812]: Connection closed by 159.100.136.21 port 45746 [preauth]
Sep  9 18:34:59 nativespace-cdp sshd[4088387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.54.224  user=root
Sep  9 18:34:59 nativespace-cdp sshd[4088387]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 18:35:02 nativespace-cdp sshd[4088387]: Failed password for root from 178.128.54.224 port 34638 ssh2
Sep  9 18:35:02 nativespace-cdp sshd[4088387]: Received disconnect from 178.128.54.224 port 34638:11: Bye Bye [preauth]
Sep  9 18:35:02 nativespace-cdp sshd[4088387]: Disconnected from 178.128.54.224 port 34638 [preauth]
Sep  9 18:35:57 nativespace-cdp sshd[4088814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.197.44.186  user=root
Sep  9 18:35:57 nativespace-cdp sshd[4088814]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 18:35:59 nativespace-cdp sshd[4088814]: Failed password for root from 20.197.44.186 port 44992 ssh2
Sep  9 18:35:59 nativespace-cdp sshd[4088814]: Received disconnect from 20.197.44.186 port 44992:11: Bye Bye [preauth]
Sep  9 18:35:59 nativespace-cdp sshd[4088814]: Disconnected from 20.197.44.186 port 44992 [preauth]
Sep  9 18:36:07 nativespace-cdp sshd[4088842]: Invalid user ubuntu from 104.248.228.79 port 46346
Sep  9 18:36:07 nativespace-cdp sshd[4088842]: input_userauth_request: invalid user ubuntu [preauth]
Sep  9 18:36:07 nativespace-cdp sshd[4088842]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:36:07 nativespace-cdp sshd[4088842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.228.79
Sep  9 18:36:08 nativespace-cdp sshd[4088842]: Failed password for invalid user ubuntu from 104.248.228.79 port 46346 ssh2
Sep  9 18:36:08 nativespace-cdp sshd[4088842]: Received disconnect from 104.248.228.79 port 46346:11: Bye Bye [preauth]
Sep  9 18:36:08 nativespace-cdp sshd[4088842]: Disconnected from 104.248.228.79 port 46346 [preauth]
Sep  9 18:36:33 nativespace-cdp sshd[4088901]: Connection closed by 159.100.136.21 port 55142 [preauth]
Sep  9 18:38:34 nativespace-cdp sshd[4089312]: Invalid user luiz from 68.183.77.4 port 49820
Sep  9 18:38:34 nativespace-cdp sshd[4089312]: input_userauth_request: invalid user luiz [preauth]
Sep  9 18:38:34 nativespace-cdp sshd[4089312]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:38:34 nativespace-cdp sshd[4089312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.77.4
Sep  9 18:38:36 nativespace-cdp sshd[4089312]: Failed password for invalid user luiz from 68.183.77.4 port 49820 ssh2
Sep  9 18:38:36 nativespace-cdp sshd[4089312]: Received disconnect from 68.183.77.4 port 49820:11: Bye Bye [preauth]
Sep  9 18:38:36 nativespace-cdp sshd[4089312]: Disconnected from 68.183.77.4 port 49820 [preauth]
Sep  9 18:40:15 nativespace-cdp sshd[4089726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.245.107.230  user=root
Sep  9 18:40:15 nativespace-cdp sshd[4089726]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 18:40:17 nativespace-cdp sshd[4089726]: Failed password for root from 85.245.107.230 port 50826 ssh2
Sep  9 18:40:17 nativespace-cdp sshd[4089726]: Received disconnect from 85.245.107.230 port 50826:11: Bye Bye [preauth]
Sep  9 18:40:17 nativespace-cdp sshd[4089726]: Disconnected from 85.245.107.230 port 50826 [preauth]
Sep  9 18:40:43 nativespace-cdp sshd[4089875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.228.79  user=root
Sep  9 18:40:43 nativespace-cdp sshd[4089875]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 18:40:44 nativespace-cdp sshd[4089882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.77.4  user=root
Sep  9 18:40:44 nativespace-cdp sshd[4089882]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 18:40:45 nativespace-cdp sshd[4089875]: Failed password for root from 104.248.228.79 port 36544 ssh2
Sep  9 18:40:45 nativespace-cdp sshd[4089875]: Received disconnect from 104.248.228.79 port 36544:11: Bye Bye [preauth]
Sep  9 18:40:45 nativespace-cdp sshd[4089875]: Disconnected from 104.248.228.79 port 36544 [preauth]
Sep  9 18:40:45 nativespace-cdp sshd[4089882]: Failed password for root from 68.183.77.4 port 59628 ssh2
Sep  9 18:40:45 nativespace-cdp sshd[4089882]: Received disconnect from 68.183.77.4 port 59628:11: Bye Bye [preauth]
Sep  9 18:40:45 nativespace-cdp sshd[4089882]: Disconnected from 68.183.77.4 port 59628 [preauth]
Sep  9 18:41:12 nativespace-cdp sshd[4090004]: Invalid user sathish from 20.197.44.186 port 56754
Sep  9 18:41:12 nativespace-cdp sshd[4090004]: input_userauth_request: invalid user sathish [preauth]
Sep  9 18:41:12 nativespace-cdp sshd[4090004]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:41:12 nativespace-cdp sshd[4090004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.197.44.186
Sep  9 18:41:14 nativespace-cdp sshd[4090010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.54.224  user=root
Sep  9 18:41:14 nativespace-cdp sshd[4090010]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep  9 18:41:14 nativespace-cdp sshd[4090004]: Failed password for invalid user sathish from 20.197.44.186 port 56754 ssh2
Sep  9 18:41:14 nativespace-cdp sshd[4090004]: Received disconnect from 20.197.44.186 port 56754:11: Bye Bye [preauth]
Sep  9 18:41:14 nativespace-cdp sshd[4090004]: Disconnected from 20.197.44.186 port 56754 [preauth]
Sep  9 18:41:16 nativespace-cdp sshd[4090010]: Failed password for root from 178.128.54.224 port 52212 ssh2
Sep  9 18:41:16 nativespace-cdp sshd[4090010]: Received disconnect from 178.128.54.224 port 52212:11: Bye Bye [preauth]
Sep  9 18:41:16 nativespace-cdp sshd[4090010]: Disconnected from 178.128.54.224 port 52212 [preauth]
Sep  9 18:41:20 nativespace-cdp sshd[4090032]: Invalid user ftpuser from 68.183.77.4 port 60454
Sep  9 18:41:20 nativespace-cdp sshd[4090032]: input_userauth_request: invalid user ftpuser [preauth]
Sep  9 18:41:20 nativespace-cdp sshd[4090032]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:41:20 nativespace-cdp sshd[4090032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.77.4
Sep  9 18:41:22 nativespace-cdp sshd[4090032]: Failed password for invalid user ftpuser from 68.183.77.4 port 60454 ssh2
Sep  9 18:41:24 nativespace-cdp sshd[4090039]: Invalid user imran from 104.248.228.79 port 47046
Sep  9 18:41:24 nativespace-cdp sshd[4090039]: input_userauth_request: invalid user imran [preauth]
Sep  9 18:41:24 nativespace-cdp sshd[4090039]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:41:24 nativespace-cdp sshd[4090039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.228.79
Sep  9 18:41:24 nativespace-cdp sshd[4090032]: Received disconnect from 68.183.77.4 port 60454:11: Bye Bye [preauth]
Sep  9 18:41:24 nativespace-cdp sshd[4090032]: Disconnected from 68.183.77.4 port 60454 [preauth]
Sep  9 18:41:27 nativespace-cdp sshd[4090039]: Failed password for invalid user imran from 104.248.228.79 port 47046 ssh2
Sep  9 18:41:33 nativespace-cdp sshd[4090131]: Connection closed by 159.100.136.21 port 36056 [preauth]
Sep  9 18:41:58 nativespace-cdp sshd[4090582]: Invalid user luiz from 20.197.44.186 port 51276
Sep  9 18:41:58 nativespace-cdp sshd[4090582]: input_userauth_request: invalid user luiz [preauth]
Sep  9 18:41:58 nativespace-cdp sshd[4090582]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:41:58 nativespace-cdp sshd[4090582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.197.44.186
Sep  9 18:42:00 nativespace-cdp sshd[4090582]: Failed password for invalid user luiz from 20.197.44.186 port 51276 ssh2
Sep  9 18:42:00 nativespace-cdp sshd[4090582]: Received disconnect from 20.197.44.186 port 51276:11: Bye Bye [preauth]
Sep  9 18:42:00 nativespace-cdp sshd[4090582]: Disconnected from 20.197.44.186 port 51276 [preauth]
Sep  9 18:42:04 nativespace-cdp sshd[4090642]: Invalid user en from 178.128.54.224 port 36650
Sep  9 18:42:04 nativespace-cdp sshd[4090642]: input_userauth_request: invalid user en [preauth]
Sep  9 18:42:04 nativespace-cdp sshd[4090642]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:42:04 nativespace-cdp sshd[4090642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.54.224
Sep  9 18:42:06 nativespace-cdp sshd[4090642]: Failed password for invalid user en from 178.128.54.224 port 36650 ssh2
Sep  9 18:42:10 nativespace-cdp sshd[4090642]: Received disconnect from 178.128.54.224 port 36650:11: Bye Bye [preauth]
Sep  9 18:42:10 nativespace-cdp sshd[4090642]: Disconnected from 178.128.54.224 port 36650 [preauth]
Sep  9 18:42:37 nativespace-cdp sshd[4090810]: Invalid user manoj from 85.245.107.230 port 52048
Sep  9 18:42:37 nativespace-cdp sshd[4090810]: input_userauth_request: invalid user manoj [preauth]
Sep  9 18:42:37 nativespace-cdp sshd[4090810]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:42:37 nativespace-cdp sshd[4090810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.245.107.230
Sep  9 18:42:38 nativespace-cdp sshd[4090810]: Failed password for invalid user manoj from 85.245.107.230 port 52048 ssh2
Sep  9 18:42:38 nativespace-cdp sshd[4090810]: Received disconnect from 85.245.107.230 port 52048:11: Bye Bye [preauth]
Sep  9 18:42:38 nativespace-cdp sshd[4090810]: Disconnected from 85.245.107.230 port 52048 [preauth]
Sep  9 18:43:28 nativespace-cdp sshd[4090942]: Invalid user en from 85.245.107.230 port 64728
Sep  9 18:43:28 nativespace-cdp sshd[4090942]: input_userauth_request: invalid user en [preauth]
Sep  9 18:43:28 nativespace-cdp sshd[4090942]: pam_unix(sshd:auth): check pass; user unknown
Sep  9 18:43:28 nativespace-cdp sshd[4090942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.245.107.230
Sep  9 18:43:30 nativespace-cdp sshd[4090942]: Failed password for invalid user en from 85.245.107.230 port 64728 ssh2
Sep  9 18:43:32 nativespace-cdp sshd[4090942]: Received disconnect from 85.245.107.230 port 64728:11: Bye Bye [preauth]
Sep  9 18:43:32 nativespace-cdp sshd[4090942]: Disconnected from 85.245.107.230 port 64728 [preauth]
Sep  9 18:46:33 nativespace-cdp sshd[4091809]: Connection closed by 159.100.136.21 port 45362 [preauth]
Sep  9 18:51:35 nativespace-cdp sshd[4092854]: Connection closed by 159.100.136.21 port 53668 [preauth]
Sep  9 18:56:35 nativespace-cdp sshd[4094004]: Connection closed by 159.100.136.21 port 34890 [preauth]
Sep  9 19:01:33 nativespace-cdp sshd[4095192]: Connection closed by 159.100.136.21 port 44342 [preauth]
Sep  9 19:06:34 nativespace-cdp sshd[4096439]: Connection closed by 159.100.136.21 port 53808 [preauth]
Sep  9 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:35 nativespace-cdp sudo[4097387]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:35 nativespace-cdp sudo[4097392]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:36 nativespace-cdp sudo[4097399]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:36 nativespace-cdp sudo[4097410]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 19:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:39 nativespace-cdp sudo[4097416]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 19:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:39 nativespace-cdp sudo[4097427]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 19:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:39 nativespace-cdp sudo[4097434]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 19:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:39 nativespace-cdp sudo[4097438]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 19:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:39 nativespace-cdp sudo[4097444]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:40 nativespace-cdp sudo[4097449]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:40 nativespace-cdp sudo[4097455]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 19:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:47 nativespace-cdp sudo[4097484]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 19:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:48 nativespace-cdp sudo[4097490]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=firstres user-2=seftvta user-3=jonhartl user-4=ultbcrra user-5=coursemc user-6=opaiscyx user-7=costestimatorco user-8=clarkass user-9=firstrel user-10=southlon user-11=highlegh user-12=firstred user-13=elecleis user-14=milloyco user-15=gilpin user-16=carsinyo user-17=fetch user-18=hubmaster user-19=putterfi user-20=ianrayne user-21=accooper user-22=thqkgnbz user-23=connectedshoppin user-24=brighto1 user-25=nstriton user-26=battlere user-27=oneoarco user-28=firstre2 user-29=vivienn1 user-30=bedfords user-31=bemadonn user-32=ggaaorgu user-33=belle user-34=newstoda user-35=skyfirec user-36=alexadmin user-37=stuartge user-38=askhform user-39=innovat1 user-40=nativene user-41=markward user-42=foundation user-43=booff user-44=maflemin user-45=lbscrmod user-46=athenare user-47=connect9 user-48=vantagep
Sep  9 19:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=jarvisin user-51=theblack user-52=hodgesonweb user-53=spectrum user-54=still user-55=agproduc user-56=leereyn1 user-57=stephani user-58=lakesan1 user-59=brmrjxl user-60=sarafoundation user-61=atestord user-62=strathar user-63=wilsonsw user-64=musorguk user-65=megacards user-66=martsblo user-67=ptkxhsbt user-68=dickemery123 user-69=lbhyisi user-70=hhdugcor user-71=magichat user-72=tomandle user-73=jennimil user-74=mcdermos user-75=chrisdal user-76=nbhavers user-77=careers user-78=david user-79=attlebor user-80=lucy user-81=onlycont user-82=branko user-83=outdoorc user-84=ranxterc user-85=hodgsonmail user-86=romaldki user-87=nove user-88=boldover user-89=sosevalu user-90=crrtipdl user-91=bakery user-92=what user-93=tstardom user-94=oubpgvbx user-95=nvihkvu user-96=sketchy user-97=cath user-98=havantho user-99=kategilpin user-100=ladburyp user-101=dancinggardener user-102=stagingerris
Sep  9 19:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=design user-104=sibtoncc user-105=asandcoc user-106=zebrapho user-107=bwppodcast user-108=steve user-109=burydropin user-110=fawcettd user-111=nsceres user-112=eatspam user-113=darkstar user-114=beauty user-115=dhyana user-116=health2045 user-117=fortunaz user-118=leftie user-119=foods user-120=putterfc user-121=nscdp user-122=philmcph user-123=ctedorgu user-124=steakbridieme user-125=firstre5 user-126=donnychicago user-127=lkpier user-128=isleofwi user-129=smrszyqg user-130=barbersh user-131=tigerlet user-132=hidden user-133=nomistakes user-134=reliable user-135=ninejimm user-136=cathski user-137=cambria1 user-138=howardon user-139=pugwash user-140=paulmca1 user-141=cwsocial user-142=hirefootballgame user-143=courseme user-144=eugincou feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 19:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 19:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:49 nativespace-cdp sudo[4097498]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 19:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:49 nativespace-cdp sudo[4097504]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-M2xsJDOqpx1s1mD6.~
Sep  9 19:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:49 nativespace-cdp sudo[4097510]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-M2xsJDOqpx1s1mD6.~'
Sep  9 19:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:49 nativespace-cdp sudo[4097514]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-M2xsJDOqpx1s1mD6.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 19:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:49 nativespace-cdp sudo[4097520]: pam_unix(sudo:session): session closed for user root
Sep  9 19:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 19:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:09:49 nativespace-cdp sudo[4097525]: pam_unix(sudo:session): session closed for user root
Sep  9 19:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 19:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 19:10:09 nativespace-cdp sudo[4097716]: pam_unix(sudo:session): session closed for user root
Sep  9 19:11:33 nativespace-cdp sshd[4098338]: Connection closed by 159.100.136.21 port 34982 [preauth]
Sep  9 19:16:33 nativespace-cdp sshd[4099608]: Connection closed by 159.100.136.21 port 44554 [preauth]
Sep  9 19:21:33 nativespace-cdp sshd[4100835]: Connection closed by 159.100.136.21 port 52654 [preauth]
Sep  9 19:26:35 nativespace-cdp sshd[4102051]: Connection closed by 159.100.136.21 port 33562 [preauth]
Sep  9 19:31:33 nativespace-cdp sshd[4103326]: Connection closed by 159.100.136.21 port 42976 [preauth]
Sep  9 19:36:33 nativespace-cdp sshd[4104960]: Connection closed by 159.100.136.21 port 51658 [preauth]
Sep  9 19:41:33 nativespace-cdp sshd[4106745]: Connection closed by 159.100.136.21 port 59998 [preauth]
Sep  9 19:46:36 nativespace-cdp sshd[4107970]: Connection closed by 159.100.136.21 port 41348 [preauth]
Sep  9 19:51:36 nativespace-cdp sshd[4109309]: Connection closed by 159.100.136.21 port 50318 [preauth]
Sep  9 19:56:34 nativespace-cdp sshd[4110697]: Connection closed by 159.100.136.21 port 59932 [preauth]
Sep  9 20:01:33 nativespace-cdp sshd[4112025]: Connection closed by 159.100.136.21 port 40372 [preauth]
Sep  9 20:06:33 nativespace-cdp sshd[4113141]: Connection closed by 159.100.136.21 port 50182 [preauth]
Sep  9 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:35 nativespace-cdp sudo[4113727]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:35 nativespace-cdp sudo[4113731]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:36 nativespace-cdp sudo[4113736]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:36 nativespace-cdp sudo[4113742]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 20:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:40 nativespace-cdp sudo[4113749]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:40 nativespace-cdp sudo[4113771]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:40 nativespace-cdp sudo[4113776]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:40 nativespace-cdp sudo[4113780]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:40 nativespace-cdp sudo[4113785]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:40 nativespace-cdp sudo[4113791]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 20:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:40 nativespace-cdp sudo[4113796]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:47 nativespace-cdp sudo[4113833]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 20:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:48 nativespace-cdp sudo[4113839]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=brmrjxl user-2=lakesan1 user-3=atestord user-4=sarafoundation user-5=strathar user-6=wilsonsw user-7=megacards user-8=musorguk user-9=martsblo user-10=ptkxhsbt user-11=dickemery123 user-12=hhdugcor user-13=lbhyisi user-14=magichat user-15=foundation user-16=markward user-17=booff user-18=lbscrmod user-19=maflemin user-20=vantagep user-21=connect9 user-22=athenare user-23=ulsukarm user-24=jarvisin user-25=hodgesonweb user-26=theblack user-27=spectrum user-28=agproduc user-29=still user-30=leereyn1 user-31=stephani user-32=nstriton user-33=brighto1 user-34=oneoarco user-35=battlere user-36=vivienn1 user-37=firstre2 user-38=bedfords user-39=bemadonn user-40=newstoda user-41=belle user-42=ggaaorgu user-43=alexadmin user-44=skyfirec user-45=stuartge user-46=askhform user-47=innovat1 user-48=nativene
Sep  9 20:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstres user-50=ultbcrra user-51=jonhartl user-52=seftvta user-53=coursemc user-54=opaiscyx user-55=costestimatorco user-56=clarkass user-57=firstrel user-58=highlegh user-59=southlon user-60=firstred user-61=elecleis user-62=gilpin user-63=milloyco user-64=fetch user-65=carsinyo user-66=putterfi user-67=hubmaster user-68=ianrayne user-69=accooper user-70=thqkgnbz user-71=connectedshoppin user-72=leftie user-73=foods user-74=fortunaz user-75=health2045 user-76=nscdp user-77=putterfc user-78=firstre5 user-79=donnychicago user-80=steakbridieme user-81=philmcph user-82=ctedorgu user-83=lkpier user-84=smrszyqg user-85=isleofwi user-86=tigerlet user-87=barbersh user-88=nomistakes user-89=hidden user-90=ninejimm user-91=reliable user-92=cathski user-93=cambria1 user-94=cwsocial user-95=howardon user-96=paulmca1 user-97=pugwash user-98=hirefootballgame user-99=courseme user-100=eugincou user-101=asandcoc
Sep  9 20:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sibtoncc user-103=zebrapho user-104=bwppodcast user-105=steve user-106=fawcettd user-107=burydropin user-108=nsceres user-109=darkstar user-110=eatspam user-111=beauty user-112=dhyana user-113=nove user-114=boldover user-115=crrtipdl user-116=sosevalu user-117=bakery user-118=what user-119=oubpgvbx user-120=tstardom user-121=nvihkvu user-122=havantho user-123=sketchy user-124=cath user-125=kategilpin user-126=stagingerris user-127=dancinggardener user-128=ladburyp user-129=design user-130=tomandle user-131=jennimil user-132=mcdermos user-133=chrisdal user-134=david user-135=careers user-136=nbhavers user-137=lucy user-138=attlebor user-139=onlycont user-140=branko user-141=outdoorc user-142=hodgsonmail user-143=ranxterc user-144=romaldki feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 20:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 20:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:48 nativespace-cdp sudo[4113848]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:49 nativespace-cdp sudo[4113859]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-eoHEfRtn2cLBswb6.~
Sep  9 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:49 nativespace-cdp sudo[4113866]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-eoHEfRtn2cLBswb6.~'
Sep  9 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:49 nativespace-cdp sudo[4113870]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-eoHEfRtn2cLBswb6.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:49 nativespace-cdp sudo[4113876]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:49 nativespace-cdp sudo[4113881]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep  9 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:55 nativespace-cdp sudo[4113887]: pam_unix(sudo:session): session closed for user root
Sep  9 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 20:09:59 nativespace-cdp sudo[4113933]: pam_unix(sudo:session): session closed for user root
Sep  9 20:11:35 nativespace-cdp sshd[4114656]: Connection closed by 159.100.136.21 port 59410 [preauth]
Sep  9 20:16:33 nativespace-cdp sshd[4116027]: Connection closed by 159.100.136.21 port 40358 [preauth]
Sep  9 20:21:33 nativespace-cdp sshd[4117092]: Connection closed by 159.100.136.21 port 49508 [preauth]
Sep  9 20:26:33 nativespace-cdp sshd[4118233]: Connection closed by 159.100.136.21 port 58760 [preauth]
Sep  9 20:31:33 nativespace-cdp sshd[4119582]: Connection closed by 159.100.136.21 port 39912 [preauth]
Sep  9 20:36:33 nativespace-cdp sshd[4121020]: Connection closed by 159.100.136.21 port 49032 [preauth]
Sep  9 20:41:33 nativespace-cdp sshd[4122513]: Connection closed by 159.100.136.21 port 58354 [preauth]
Sep  9 20:46:33 nativespace-cdp sshd[4123799]: Connection closed by 159.100.136.21 port 39788 [preauth]
Sep  9 20:51:33 nativespace-cdp sshd[4125072]: Connection closed by 159.100.136.21 port 49442 [preauth]
Sep  9 20:56:34 nativespace-cdp sshd[4126351]: Connection closed by 159.100.136.21 port 57928 [preauth]
Sep  9 21:01:33 nativespace-cdp sshd[4127627]: Connection closed by 159.100.136.21 port 39278 [preauth]
Sep  9 21:06:33 nativespace-cdp sshd[4128851]: Connection closed by 159.100.136.21 port 48600 [preauth]
Sep  9 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:41 nativespace-cdp sudo[4129702]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:41 nativespace-cdp sudo[4129707]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:42 nativespace-cdp sudo[4129713]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:42 nativespace-cdp sudo[4129725]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:46 nativespace-cdp sudo[4129732]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 21:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:46 nativespace-cdp sudo[4129747]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 21:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:46 nativespace-cdp sudo[4129752]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 21:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:46 nativespace-cdp sudo[4129756]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 21:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:46 nativespace-cdp sudo[4129761]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 21:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:46 nativespace-cdp sudo[4129767]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 21:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:46 nativespace-cdp sudo[4129772]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:53 nativespace-cdp sudo[4129792]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 21:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:54 nativespace-cdp sudo[4129800]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=dhyana user-2=beauty user-3=eatspam user-4=darkstar user-5=nsceres user-6=burydropin user-7=fawcettd user-8=steve user-9=bwppodcast user-10=zebrapho user-11=asandcoc user-12=sibtoncc user-13=eugincou user-14=courseme user-15=hirefootballgame user-16=pugwash user-17=paulmca1 user-18=howardon user-19=cwsocial user-20=cathski user-21=cambria1 user-22=reliable user-23=ninejimm user-24=hidden user-25=nomistakes user-26=barbersh user-27=tigerlet user-28=smrszyqg user-29=isleofwi user-30=lkpier user-31=ctedorgu user-32=philmcph user-33=steakbridieme user-34=firstre5 user-35=donnychicago user-36=putterfc user-37=nscdp user-38=health2045 user-39=fortunaz user-40=leftie user-41=foods user-42=romaldki user-43=ranxterc user-44=outdoorc user-45=hodgsonmail user-46=branko user-47=onlycont user-48=attlebor
Sep  9 21:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=lucy user-50=careers user-51=nbhavers user-52=david user-53=chrisdal user-54=mcdermos user-55=jennimil user-56=tomandle user-57=design user-58=ladburyp user-59=stagingerris user-60=dancinggardener user-61=kategilpin user-62=cath user-63=sketchy user-64=havantho user-65=nvihkvu user-66=oubpgvbx user-67=tstardom user-68=what user-69=bakery user-70=sosevalu user-71=crrtipdl user-72=boldover user-73=nove user-74=stephani user-75=leereyn1 user-76=still user-77=agproduc user-78=spectrum user-79=theblack user-80=hodgesonweb user-81=jarvisin user-82=ulsukarm user-83=connect9 user-84=athenare user-85=vantagep user-86=maflemin user-87=lbscrmod user-88=markward user-89=booff user-90=foundation user-91=magichat user-92=lbhyisi user-93=hhdugcor user-94=dickemery123 user-95=ptkxhsbt user-96=martsblo user-97=musorguk user-98=megacards user-99=wilsonsw user-100=strathar user-101=sarafoundation user-102=atestord
Sep  9 21:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=brmrjxl user-104=lakesan1 user-105=connectedshoppin user-106=thqkgnbz user-107=accooper user-108=ianrayne user-109=hubmaster user-110=putterfi user-111=carsinyo user-112=fetch user-113=milloyco user-114=gilpin user-115=elecleis user-116=firstred user-117=southlon user-118=highlegh user-119=clarkass user-120=firstrel user-121=costestimatorco user-122=coursemc user-123=opaiscyx user-124=jonhartl user-125=seftvta user-126=ultbcrra user-127=firstres user-128=nativene user-129=innovat1 user-130=askhform user-131=stuartge user-132=skyfirec user-133=alexadmin user-134=belle user-135=ggaaorgu user-136=newstoda user-137=bemadonn user-138=bedfords user-139=firstre2 user-140=vivienn1 user-141=battlere user-142=oneoarco user-143=brighto1 user-144=nstriton feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 21:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 21:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:56 nativespace-cdp sudo[4129811]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 21:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:56 nativespace-cdp sudo[4129820]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3FruKtgRyv3MNVcu.~
Sep  9 21:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:56 nativespace-cdp sudo[4129826]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3FruKtgRyv3MNVcu.~'
Sep  9 21:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:56 nativespace-cdp sudo[4129830]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3FruKtgRyv3MNVcu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 21:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:56 nativespace-cdp sudo[4129836]: pam_unix(sudo:session): session closed for user root
Sep  9 21:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 21:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:09:56 nativespace-cdp sudo[4129841]: pam_unix(sudo:session): session closed for user root
Sep  9 21:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 21:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:10:16 nativespace-cdp sudo[4130031]: pam_unix(sudo:session): session closed for user root
Sep  9 21:11:36 nativespace-cdp sshd[4130622]: Connection closed by 159.100.136.21 port 58010 [preauth]
Sep  9 21:16:33 nativespace-cdp sshd[4131776]: Connection closed by 159.100.136.21 port 39198 [preauth]
Sep  9 21:21:36 nativespace-cdp sshd[4132880]: Connection closed by 159.100.136.21 port 47368 [preauth]
Sep  9 21:26:34 nativespace-cdp sshd[4134225]: Connection closed by 159.100.136.21 port 56290 [preauth]
Sep  9 21:31:33 nativespace-cdp sshd[4135829]: Connection closed by 159.100.136.21 port 37170 [preauth]
Sep  9 21:36:55 nativespace-cdp crond[4137176]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  9 21:36:55 nativespace-cdp crond[4137177]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep  9 21:37:11 nativespace-cdp sshd[4137331]: Did not receive identification string from 159.100.136.21 port 46574
Sep  9 21:37:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:37:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:37:50 nativespace-cdp sudo[4137720]: pam_unix(sudo:session): session closed for user root
Sep  9 21:37:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status alexadmin
Sep  9 21:37:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:37:59 nativespace-cdp sudo[4137733]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:38:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:02 nativespace-cdp sudo[4137789]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fawcettd
Sep  9 21:38:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:03 nativespace-cdp sudo[4137794]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:38:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:06 nativespace-cdp sudo[4137820]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status isleofwi
Sep  9 21:38:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:07 nativespace-cdp sudo[4137824]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:38:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:10 nativespace-cdp sudo[4137843]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lbscrmod
Sep  9 21:38:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:11 nativespace-cdp sudo[4137848]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:38:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:12 nativespace-cdp sudo[4137867]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status mcdermos
Sep  9 21:38:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:13 nativespace-cdp sudo[4137871]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:38:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:14 nativespace-cdp sudo[4137889]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status mcdermos
Sep  9 21:38:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:14 nativespace-cdp sudo[4137895]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:38:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:16 nativespace-cdp sudo[4137907]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status musorguk
Sep  9 21:38:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:16 nativespace-cdp sudo[4137912]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:38:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:18 nativespace-cdp sudo[4137928]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status steakbridieme
Sep  9 21:38:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:19 nativespace-cdp sudo[4137933]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:38:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:20 nativespace-cdp sudo[4137944]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status tigerlet
Sep  9 21:38:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:21 nativespace-cdp sudo[4137948]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 21:38:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:29 nativespace-cdp sudo[4137979]: pam_unix(sudo:session): session closed for user root
Sep  9 21:38:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status tigerlet
Sep  9 21:38:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 21:38:29 nativespace-cdp sudo[4137983]: pam_unix(sudo:session): session closed for user root
Sep  9 21:41:36 nativespace-cdp sshd[4138961]: Connection closed by 159.100.136.21 port 55894 [preauth]
Sep  9 21:46:33 nativespace-cdp sshd[4140449]: Connection closed by 159.100.136.21 port 36922 [preauth]
Sep  9 21:51:33 nativespace-cdp sshd[4141654]: Connection closed by 159.100.136.21 port 46050 [preauth]
Sep  9 21:56:33 nativespace-cdp sshd[4143032]: Connection closed by 159.100.136.21 port 54742 [preauth]
Sep  9 21:58:52 nativespace-cdp sshd[4143767]: Connection closed by 94.141.120.242 port 52008 [preauth]
Sep  9 22:01:33 nativespace-cdp sshd[4144514]: Connection closed by 159.100.136.21 port 34704 [preauth]
Sep  9 22:06:37 nativespace-cdp sshd[4145665]: Connection closed by 159.100.136.21 port 43736 [preauth]
Sep  9 22:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 22:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:09:58 nativespace-cdp sudo[4146309]: pam_unix(sudo:session): session closed for user root
Sep  9 22:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 22:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:09:58 nativespace-cdp sudo[4146312]: pam_unix(sudo:session): session closed for user root
Sep  9 22:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 22:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:09:59 nativespace-cdp sudo[4146318]: pam_unix(sudo:session): session closed for user root
Sep  9 22:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 22:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:09:59 nativespace-cdp sudo[4146329]: pam_unix(sudo:session): session closed for user root
Sep  9 22:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 22:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:04 nativespace-cdp sudo[4146335]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 22:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:04 nativespace-cdp sudo[4146461]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 22:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:04 nativespace-cdp sudo[4146464]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 22:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:04 nativespace-cdp sudo[4146467]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 22:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:05 nativespace-cdp sudo[4146470]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 22:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:05 nativespace-cdp sudo[4146473]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 22:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:05 nativespace-cdp sudo[4146476]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 22:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:13 nativespace-cdp sudo[4146514]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 22:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:13 nativespace-cdp sudo[4146519]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=branko user-2=ranxterc user-3=outdoorc user-4=hodgsonmail user-5=romaldki user-6=attlebor user-7=lucy user-8=onlycont user-9=mcdermos user-10=chrisdal user-11=careers user-12=nbhavers user-13=david user-14=tomandle user-15=jennimil user-16=kategilpin user-17=ladburyp user-18=stagingerris user-19=dancinggardener user-20=design user-21=what user-22=oubpgvbx user-23=tstardom user-24=nvihkvu user-25=cath user-26=sketchy user-27=havantho user-28=sosevalu user-29=crrtipdl user-30=bakery user-31=nove user-32=boldover user-33=eatspam user-34=darkstar user-35=beauty user-36=dhyana user-37=burydropin user-38=fawcettd user-39=nsceres user-40=zebrapho user-41=bwppodcast user-42=steve user-43=sibtoncc user-44=asandcoc user-45=hirefootballgame user-46=courseme user-47=eugincou user-48=ninejimm
Sep  9 22:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=reliable user-50=cathski user-51=cambria1 user-52=pugwash user-53=paulmca1 user-54=howardon user-55=cwsocial user-56=smrszyqg user-57=isleofwi user-58=tigerlet user-59=barbersh user-60=hidden user-61=nomistakes user-62=health2045 user-63=fortunaz user-64=foods user-65=leftie user-66=putterfc user-67=nscdp user-68=ctedorgu user-69=philmcph user-70=firstre5 user-71=donnychicago user-72=steakbridieme user-73=lkpier user-74=ianrayne user-75=accooper user-76=thqkgnbz user-77=connectedshoppin user-78=elecleis user-79=milloyco user-80=gilpin user-81=carsinyo user-82=fetch user-83=putterfi user-84=hubmaster user-85=costestimatorco user-86=clarkass user-87=firstrel user-88=southlon user-89=highlegh user-90=firstred user-91=firstres user-92=jonhartl user-93=seftvta user-94=ultbcrra user-95=coursemc user-96=opaiscyx user-97=stuartge user-98=askhform user-99=innovat1 user-100=nativene user-101=alexadmin
Sep  9 22:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=skyfirec user-103=bedfords user-104=bemadonn user-105=belle user-106=ggaaorgu user-107=newstoda user-108=brighto1 user-109=nstriton user-110=battlere user-111=oneoarco user-112=firstre2 user-113=vivienn1 user-114=still user-115=agproduc user-116=leereyn1 user-117=stephani user-118=jarvisin user-119=hodgesonweb user-120=theblack user-121=spectrum user-122=ulsukarm user-123=foundation user-124=markward user-125=booff user-126=maflemin user-127=lbscrmod user-128=athenare user-129=connect9 user-130=vantagep user-131=lbhyisi user-132=hhdugcor user-133=magichat user-134=martsblo user-135=ptkxhsbt user-136=dickemery123 user-137=wilsonsw user-138=musorguk user-139=megacards user-140=lakesan1 user-141=brmrjxl user-142=sarafoundation user-143=atestord user-144=strathar feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep  9 22:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 22:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:14 nativespace-cdp sudo[4146524]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 22:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:15 nativespace-cdp sudo[4146535]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NhjbWzgeHknPWw05.~
Sep  9 22:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:15 nativespace-cdp sudo[4146539]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NhjbWzgeHknPWw05.~'
Sep  9 22:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:15 nativespace-cdp sudo[4146542]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-NhjbWzgeHknPWw05.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 22:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:15 nativespace-cdp sudo[4146546]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 22:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:15 nativespace-cdp sudo[4146549]: pam_unix(sudo:session): session closed for user root
Sep  9 22:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 22:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 22:10:33 nativespace-cdp sudo[4146657]: pam_unix(sudo:session): session closed for user root
Sep  9 22:11:35 nativespace-cdp sshd[4147076]: Connection closed by 159.100.136.21 port 53460 [preauth]
Sep  9 22:16:33 nativespace-cdp sshd[4148289]: Connection closed by 159.100.136.21 port 34716 [preauth]
Sep  9 22:21:34 nativespace-cdp sshd[4149410]: Connection closed by 159.100.136.21 port 43830 [preauth]
Sep  9 22:26:33 nativespace-cdp sshd[4150549]: Connection closed by 159.100.136.21 port 53116 [preauth]
Sep  9 22:31:33 nativespace-cdp sshd[4152158]: Connection closed by 159.100.136.21 port 34188 [preauth]
Sep  9 22:36:33 nativespace-cdp sshd[4153334]: Connection closed by 159.100.136.21 port 44202 [preauth]
Sep  9 22:41:33 nativespace-cdp sshd[4154529]: Connection closed by 159.100.136.21 port 53552 [preauth]
Sep  9 22:46:34 nativespace-cdp sshd[4156132]: Connection closed by 159.100.136.21 port 34792 [preauth]
Sep  9 22:51:37 nativespace-cdp sshd[4157237]: Connection closed by 159.100.136.21 port 43860 [preauth]
Sep  9 22:56:33 nativespace-cdp sshd[4158318]: Connection closed by 159.100.136.21 port 52774 [preauth]
Sep  9 23:01:36 nativespace-cdp sshd[4159577]: Connection closed by 159.100.136.21 port 34028 [preauth]
Sep  9 23:06:35 nativespace-cdp sshd[4160804]: Connection closed by 159.100.136.21 port 44064 [preauth]
Sep  9 23:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep  9 23:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:57 nativespace-cdp sudo[4161493]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep  9 23:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:57 nativespace-cdp sudo[4161501]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep  9 23:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:58 nativespace-cdp sudo[4161506]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep  9 23:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:58 nativespace-cdp sudo[4161514]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep  9 23:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:59 nativespace-cdp sudo[4161520]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep  9 23:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:59 nativespace-cdp sudo[4161529]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep  9 23:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:59 nativespace-cdp sudo[4161533]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep  9 23:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:59 nativespace-cdp sudo[4161538]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep  9 23:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:59 nativespace-cdp sudo[4161543]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep  9 23:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:59 nativespace-cdp sudo[4161548]: pam_unix(sudo:session): session closed for user root
Sep  9 23:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep  9 23:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:09:59 nativespace-cdp sudo[4161554]: pam_unix(sudo:session): session closed for user root
Sep  9 23:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep  9 23:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:10:01 nativespace-cdp sudo[4161654]: pam_unix(sudo:session): session closed for user root
Sep  9 23:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep  9 23:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:10:01 nativespace-cdp sudo[4161662]: pam_unix(sudo:session): session closed for user root
Sep  9 23:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=magichat user-2=hhdugcor user-3=lbhyisi user-4=ptkxhsbt user-5=dickemery123 user-6=martsblo user-7=megacards user-8=musorguk user-9=wilsonsw user-10=atestord user-11=sarafoundation user-12=strathar user-13=lakesan1 user-14=brmrjxl user-15=leereyn1 user-16=stephani user-17=agproduc user-18=still user-19=theblack user-20=hodgesonweb user-21=spectrum user-22=jarvisin user-23=ulsukarm user-24=lbscrmod user-25=maflemin user-26=vantagep user-27=connect9 user-28=athenare user-29=markward user-30=foundation user-31=booff user-32=nativene user-33=stuartge user-34=askhform user-35=innovat1 user-36=alexadmin user-37=skyfirec user-38=bemadonn user-39=newstoda user-40=ggaaorgu user-41=belle user-42=bedfords user-43=oneoarco user-44=battlere user-45=vivienn1 user-46=firstre2 user-47=nstriton user-48=brighto1
Sep  9 23:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=thqkgnbz user-50=connectedshoppin user-51=ianrayne user-52=accooper user-53=fetch user-54=carsinyo user-55=hubmaster user-56=putterfi user-57=elecleis user-58=milloyco user-59=gilpin user-60=highlegh user-61=southlon user-62=firstred user-63=costestimatorco user-64=firstrel user-65=clarkass user-66=coursemc user-67=opaiscyx user-68=firstres user-69=ultbcrra user-70=jonhartl user-71=seftvta user-72=courseme user-73=eugincou user-74=hirefootballgame user-75=cwsocial user-76=howardon user-77=paulmca1 user-78=pugwash user-79=ninejimm user-80=reliable user-81=cathski user-82=cambria1 user-83=tigerlet user-84=barbersh user-85=nomistakes user-86=hidden user-87=smrszyqg user-88=isleofwi user-89=donnychicago user-90=firstre5 user-91=steakbridieme user-92=ctedorgu user-93=philmcph user-94=lkpier user-95=foods user-96=leftie user-97=fortunaz user-98=health2045 user-99=nscdp user-100=putterfc user-101=dhyana
Sep  9 23:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=darkstar user-103=eatspam user-104=beauty user-105=nsceres user-106=fawcettd user-107=burydropin user-108=steve user-109=zebrapho user-110=bwppodcast user-111=asandcoc user-112=sibtoncc user-113=design user-114=kategilpin user-115=stagingerris user-116=dancinggardener user-117=ladburyp user-118=nvihkvu user-119=havantho user-120=cath user-121=sketchy user-122=what user-123=oubpgvbx user-124=tstardom user-125=crrtipdl user-126=sosevalu user-127=bakery user-128=boldover user-129=nove user-130=romaldki user-131=branko user-132=ranxterc user-133=outdoorc user-134=hodgsonmail user-135=onlycont user-136=lucy user-137=attlebor user-138=david user-139=nbhavers user-140=careers user-141=mcdermos user-142=chrisdal user-143=jennimil user-144=tomandle feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep  9 23:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep  9 23:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:10:02 nativespace-cdp sudo[4161672]: pam_unix(sudo:session): session closed for user root
Sep  9 23:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 23:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:10:02 nativespace-cdp sudo[4161695]: pam_unix(sudo:session): session closed for user root
Sep  9 23:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-XJcBv2KCh2oofCH1.~
Sep  9 23:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:10:02 nativespace-cdp sudo[4161698]: pam_unix(sudo:session): session closed for user root
Sep  9 23:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-XJcBv2KCh2oofCH1.~'
Sep  9 23:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:10:02 nativespace-cdp sudo[4161703]: pam_unix(sudo:session): session closed for user root
Sep  9 23:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-XJcBv2KCh2oofCH1.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep  9 23:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:10:02 nativespace-cdp sudo[4161708]: pam_unix(sudo:session): session closed for user root
Sep  9 23:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep  9 23:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:10:02 nativespace-cdp sudo[4161711]: pam_unix(sudo:session): session closed for user root
Sep  9 23:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep  9 23:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep  9 23:10:04 nativespace-cdp sudo[4161739]: pam_unix(sudo:session): session closed for user root
Sep  9 23:11:34 nativespace-cdp sshd[4162367]: Connection closed by 159.100.136.21 port 53476 [preauth]
Sep  9 23:16:34 nativespace-cdp sshd[4163523]: Connection closed by 159.100.136.21 port 34320 [preauth]
Sep  9 23:21:33 nativespace-cdp sshd[4164549]: Connection closed by 159.100.136.21 port 43572 [preauth]
Sep  9 23:26:33 nativespace-cdp sshd[4165926]: Connection closed by 159.100.136.21 port 52970 [preauth]
Sep  9 23:31:33 nativespace-cdp sshd[4167156]: Connection closed by 159.100.136.21 port 33454 [preauth]
Sep  9 23:36:33 nativespace-cdp sshd[4168214]: Connection closed by 159.100.136.21 port 43222 [preauth]
Sep  9 23:41:33 nativespace-cdp sshd[4169466]: Connection closed by 159.100.136.21 port 52436 [preauth]
Sep  9 23:46:33 nativespace-cdp sshd[4170627]: Connection closed by 159.100.136.21 port 33616 [preauth]
Sep  9 23:51:33 nativespace-cdp sshd[4171644]: Connection closed by 159.100.136.21 port 43138 [preauth]
Sep  9 23:56:34 nativespace-cdp sshd[4172956]: Connection closed by 159.100.136.21 port 52968 [preauth]
Sep 10 00:01:34 nativespace-cdp sshd[4174352]: Connection closed by 159.100.136.21 port 34022 [preauth]
Sep 10 00:06:33 nativespace-cdp sshd[4175379]: Connection closed by 159.100.136.21 port 43592 [preauth]
Sep 10 00:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 00:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:57 nativespace-cdp sudo[4176019]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 00:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:57 nativespace-cdp sudo[4176024]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 00:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:58 nativespace-cdp sudo[4176029]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 00:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:58 nativespace-cdp sudo[4176035]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 00:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:59 nativespace-cdp sudo[4176041]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 00:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:59 nativespace-cdp sudo[4176050]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 00:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:59 nativespace-cdp sudo[4176054]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 00:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:59 nativespace-cdp sudo[4176060]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 00:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:59 nativespace-cdp sudo[4176065]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 00:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:59 nativespace-cdp sudo[4176070]: pam_unix(sudo:session): session closed for user root
Sep 10 00:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 00:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:09:59 nativespace-cdp sudo[4176076]: pam_unix(sudo:session): session closed for user root
Sep 10 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:10:03 nativespace-cdp sudo[4176218]: pam_unix(sudo:session): session closed for user root
Sep 10 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:10:03 nativespace-cdp sudo[4176223]: pam_unix(sudo:session): session closed for user root
Sep 10 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=design user-2=ladburyp user-3=dancinggardener user-4=stagingerris user-5=kategilpin user-6=cath user-7=sketchy user-8=havantho user-9=nvihkvu user-10=oubpgvbx user-11=tstardom user-12=what user-13=bakery user-14=sosevalu user-15=crrtipdl user-16=boldover user-17=nove user-18=romaldki user-19=ranxterc user-20=hodgsonmail user-21=outdoorc user-22=branko user-23=onlycont user-24=attlebor user-25=lucy user-26=careers user-27=nbhavers user-28=david user-29=chrisdal user-30=mcdermos user-31=jennimil user-32=tomandle user-33=eugincou user-34=courseme user-35=hirefootballgame user-36=pugwash user-37=paulmca1 user-38=howardon user-39=cwsocial user-40=cambria1 user-41=cathski user-42=reliable user-43=ninejimm user-44=hidden user-45=nomistakes user-46=barbersh user-47=tigerlet user-48=smrszyqg
Sep 10 00:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=isleofwi user-50=lkpier user-51=ctedorgu user-52=philmcph user-53=donnychicago user-54=firstre5 user-55=steakbridieme user-56=putterfc user-57=nscdp user-58=health2045 user-59=fortunaz user-60=leftie user-61=foods user-62=dhyana user-63=beauty user-64=eatspam user-65=darkstar user-66=nsceres user-67=burydropin user-68=fawcettd user-69=steve user-70=bwppodcast user-71=zebrapho user-72=asandcoc user-73=sibtoncc user-74=nativene user-75=innovat1 user-76=stuartge user-77=askhform user-78=skyfirec user-79=alexadmin user-80=ggaaorgu user-81=belle user-82=newstoda user-83=bemadonn user-84=bedfords user-85=firstre2 user-86=vivienn1 user-87=battlere user-88=oneoarco user-89=brighto1 user-90=nstriton user-91=connectedshoppin user-92=thqkgnbz user-93=accooper user-94=ianrayne user-95=putterfi user-96=hubmaster user-97=carsinyo user-98=fetch user-99=gilpin user-100=milloyco user-101=elecleis user-102=firstred
Sep 10 00:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=southlon user-104=highlegh user-105=firstrel user-106=clarkass user-107=costestimatorco user-108=opaiscyx user-109=coursemc user-110=jonhartl user-111=seftvta user-112=ultbcrra user-113=firstres user-114=magichat user-115=lbhyisi user-116=hhdugcor user-117=dickemery123 user-118=ptkxhsbt user-119=martsblo user-120=musorguk user-121=megacards user-122=wilsonsw user-123=strathar user-124=sarafoundation user-125=atestord user-126=brmrjxl user-127=lakesan1 user-128=stephani user-129=leereyn1 user-130=still user-131=agproduc user-132=spectrum user-133=hodgesonweb user-134=theblack user-135=jarvisin user-136=ulsukarm user-137=athenare user-138=connect9 user-139=vantagep user-140=maflemin user-141=lbscrmod user-142=foundation user-143=markward user-144=booff feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 00:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:10:04 nativespace-cdp sudo[4176231]: pam_unix(sudo:session): session closed for user root
Sep 10 00:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 00:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:10:04 nativespace-cdp sudo[4176237]: pam_unix(sudo:session): session closed for user root
Sep 10 00:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oOVYE0pOgFuALMbN.~
Sep 10 00:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:10:04 nativespace-cdp sudo[4176240]: pam_unix(sudo:session): session closed for user root
Sep 10 00:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oOVYE0pOgFuALMbN.~'
Sep 10 00:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:10:04 nativespace-cdp sudo[4176246]: pam_unix(sudo:session): session closed for user root
Sep 10 00:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oOVYE0pOgFuALMbN.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 00:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:10:04 nativespace-cdp sudo[4176251]: pam_unix(sudo:session): session closed for user root
Sep 10 00:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 00:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:10:04 nativespace-cdp sudo[4176254]: pam_unix(sudo:session): session closed for user root
Sep 10 00:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 00:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 00:10:10 nativespace-cdp sudo[4176303]: pam_unix(sudo:session): session closed for user root
Sep 10 00:11:33 nativespace-cdp sshd[4176624]: Connection closed by 159.100.136.21 port 51918 [preauth]
Sep 10 00:16:33 nativespace-cdp sshd[4178031]: Connection closed by 159.100.136.21 port 60700 [preauth]
Sep 10 00:21:33 nativespace-cdp sshd[4179105]: Connection closed by 159.100.136.21 port 41850 [preauth]
Sep 10 00:26:34 nativespace-cdp sshd[4180186]: Connection closed by 159.100.136.21 port 51502 [preauth]
Sep 10 00:31:36 nativespace-cdp sshd[4181591]: Connection closed by 159.100.136.21 port 60222 [preauth]
Sep 10 00:36:38 nativespace-cdp sshd[4182696]: Connection closed by 159.100.136.21 port 40728 [preauth]
Sep 10 00:41:35 nativespace-cdp sshd[4184125]: Connection closed by 159.100.136.21 port 49678 [preauth]
Sep 10 00:46:33 nativespace-cdp sshd[4185184]: Connection closed by 159.100.136.21 port 59414 [preauth]
Sep 10 00:51:33 nativespace-cdp sshd[4186283]: Connection closed by 159.100.136.21 port 40402 [preauth]
Sep 10 00:56:33 nativespace-cdp sshd[4187516]: Connection closed by 159.100.136.21 port 50146 [preauth]
Sep 10 01:01:36 nativespace-cdp sshd[4188975]: Connection closed by 159.100.136.21 port 58936 [preauth]
Sep 10 01:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 01:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:57 nativespace-cdp sudo[4190614]: pam_unix(sudo:session): session closed for user root
Sep 10 01:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 01:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:58 nativespace-cdp sudo[4190617]: pam_unix(sudo:session): session closed for user root
Sep 10 01:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 01:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:58 nativespace-cdp sudo[4190621]: pam_unix(sudo:session): session closed for user root
Sep 10 01:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 01:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:58 nativespace-cdp sudo[4190626]: pam_unix(sudo:session): session closed for user root
Sep 10 01:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 01:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:59 nativespace-cdp sudo[4190629]: pam_unix(sudo:session): session closed for user root
Sep 10 01:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 01:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:59 nativespace-cdp sudo[4190636]: pam_unix(sudo:session): session closed for user root
Sep 10 01:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 01:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:59 nativespace-cdp sudo[4190639]: pam_unix(sudo:session): session closed for user root
Sep 10 01:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 01:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:59 nativespace-cdp sudo[4190642]: pam_unix(sudo:session): session closed for user root
Sep 10 01:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 01:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:59 nativespace-cdp sudo[4190645]: pam_unix(sudo:session): session closed for user root
Sep 10 01:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 01:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:09:59 nativespace-cdp sudo[4190648]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 01:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:00 nativespace-cdp sudo[4190651]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 01:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:01 nativespace-cdp sudo[4190746]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 01:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:02 nativespace-cdp sudo[4190756]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bakery user-2=crrtipdl user-3=sosevalu user-4=boldover user-5=nove user-6=design user-7=dancinggardener user-8=stagingerris user-9=ladburyp user-10=kategilpin user-11=havantho user-12=cath user-13=sketchy user-14=nvihkvu user-15=tstardom user-16=oubpgvbx user-17=what user-18=david user-19=nbhavers user-20=careers user-21=chrisdal user-22=mcdermos user-23=jennimil user-24=tomandle user-25=romaldki user-26=hodgsonmail user-27=outdoorc user-28=ranxterc user-29=branko user-30=onlycont user-31=lucy user-32=attlebor user-33=nomistakes user-34=hidden user-35=barbersh user-36=tigerlet user-37=isleofwi user-38=smrszyqg user-39=lkpier user-40=firstre5 user-41=donnychicago user-42=steakbridieme user-43=ctedorgu user-44=philmcph user-45=nscdp user-46=putterfc user-47=leftie user-48=foods user-49=fortunaz
Sep 10 01:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=health2045 user-51=eugincou user-52=courseme user-53=hirefootballgame user-54=cwsocial user-55=howardon user-56=paulmca1 user-57=pugwash user-58=cambria1 user-59=cathski user-60=ninejimm user-61=reliable user-62=steve user-63=bwppodcast user-64=zebrapho user-65=sibtoncc user-66=asandcoc user-67=dhyana user-68=beauty user-69=darkstar user-70=eatspam user-71=nsceres user-72=fawcettd user-73=burydropin user-74=newstoda user-75=belle user-76=ggaaorgu user-77=bemadonn user-78=bedfords user-79=vivienn1 user-80=firstre2 user-81=oneoarco user-82=battlere user-83=nstriton user-84=brighto1 user-85=nativene user-86=innovat1 user-87=askhform user-88=stuartge user-89=alexadmin user-90=skyfirec user-91=firstred user-92=highlegh user-93=southlon user-94=firstrel user-95=clarkass user-96=costestimatorco user-97=opaiscyx user-98=coursemc user-99=ultbcrra user-100=jonhartl user-101=seftvta user-102=firstres
Sep 10 01:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=connectedshoppin user-104=thqkgnbz user-105=accooper user-106=ianrayne user-107=putterfi user-108=hubmaster user-109=fetch user-110=carsinyo user-111=gilpin user-112=milloyco user-113=elecleis user-114=megacards user-115=musorguk user-116=wilsonsw user-117=strathar user-118=atestord user-119=sarafoundation user-120=brmrjxl user-121=lakesan1 user-122=magichat user-123=hhdugcor user-124=lbhyisi user-125=dickemery123 user-126=ptkxhsbt user-127=martsblo user-128=ulsukarm user-129=vantagep user-130=athenare user-131=connect9 user-132=lbscrmod user-133=maflemin user-134=booff user-135=markward user-136=foundation user-137=stephani user-138=leereyn1 user-139=agproduc user-140=still user-141=spectrum user-142=theblack user-143=hodgesonweb user-144=jarvisin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 01:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 01:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:02 nativespace-cdp sudo[4190766]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 01:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:02 nativespace-cdp sudo[4190776]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F01rAaIpC8HbvPbn.~
Sep 10 01:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:02 nativespace-cdp sudo[4190779]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F01rAaIpC8HbvPbn.~'
Sep 10 01:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:02 nativespace-cdp sudo[4190782]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F01rAaIpC8HbvPbn.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 01:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:02 nativespace-cdp sudo[4190786]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 01:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:02 nativespace-cdp sudo[4190789]: pam_unix(sudo:session): session closed for user root
Sep 10 01:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 01:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 01:10:07 nativespace-cdp sudo[4190844]: pam_unix(sudo:session): session closed for user root
Sep 10 01:11:33 nativespace-cdp sshd[4191459]: Connection closed by 159.100.136.21 port 47590 [preauth]
Sep 10 01:16:36 nativespace-cdp sshd[4192525]: Connection closed by 159.100.136.21 port 57162 [preauth]
Sep 10 01:18:35 nativespace-cdp sshd[4192868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.84.9.106  user=root
Sep 10 01:18:35 nativespace-cdp sshd[4192868]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 01:18:37 nativespace-cdp sshd[4192868]: Failed password for root from 191.84.9.106 port 42032 ssh2
Sep 10 01:18:37 nativespace-cdp sshd[4192868]: Received disconnect from 191.84.9.106 port 42032:11: Bye Bye [preauth]
Sep 10 01:18:37 nativespace-cdp sshd[4192868]: Disconnected from 191.84.9.106 port 42032 [preauth]
Sep 10 01:19:50 nativespace-cdp sshd[4193064]: Invalid user liu from 177.115.11.175 port 54159
Sep 10 01:19:50 nativespace-cdp sshd[4193064]: input_userauth_request: invalid user liu [preauth]
Sep 10 01:19:50 nativespace-cdp sshd[4193064]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 01:19:50 nativespace-cdp sshd[4193064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.115.11.175
Sep 10 01:19:53 nativespace-cdp sshd[4193064]: Failed password for invalid user liu from 177.115.11.175 port 54159 ssh2
Sep 10 01:19:53 nativespace-cdp sshd[4193064]: Received disconnect from 177.115.11.175 port 54159:11: Bye Bye [preauth]
Sep 10 01:19:53 nativespace-cdp sshd[4193064]: Disconnected from 177.115.11.175 port 54159 [preauth]
Sep 10 01:21:33 nativespace-cdp sshd[4193540]: Connection closed by 159.100.136.21 port 37748 [preauth]
Sep 10 01:22:43 nativespace-cdp sshd[4193712]: Invalid user ssl from 191.84.9.106 port 35194
Sep 10 01:22:43 nativespace-cdp sshd[4193712]: input_userauth_request: invalid user ssl [preauth]
Sep 10 01:22:43 nativespace-cdp sshd[4193712]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 01:22:43 nativespace-cdp sshd[4193712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.84.9.106
Sep 10 01:22:45 nativespace-cdp sshd[4193712]: Failed password for invalid user ssl from 191.84.9.106 port 35194 ssh2
Sep 10 01:22:45 nativespace-cdp sshd[4193712]: Received disconnect from 191.84.9.106 port 35194:11: Bye Bye [preauth]
Sep 10 01:22:45 nativespace-cdp sshd[4193712]: Disconnected from 191.84.9.106 port 35194 [preauth]
Sep 10 01:23:38 nativespace-cdp sshd[4193932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.84.9.106  user=root
Sep 10 01:23:38 nativespace-cdp sshd[4193932]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 01:23:40 nativespace-cdp sshd[4193932]: Failed password for root from 191.84.9.106 port 54530 ssh2
Sep 10 01:23:42 nativespace-cdp sshd[4193932]: Received disconnect from 191.84.9.106 port 54530:11: Bye Bye [preauth]
Sep 10 01:23:42 nativespace-cdp sshd[4193932]: Disconnected from 191.84.9.106 port 54530 [preauth]
Sep 10 01:23:56 nativespace-cdp sshd[4193976]: Invalid user andrei from 186.7.151.113 port 55185
Sep 10 01:23:56 nativespace-cdp sshd[4193976]: input_userauth_request: invalid user andrei [preauth]
Sep 10 01:23:56 nativespace-cdp sshd[4193976]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 01:23:56 nativespace-cdp sshd[4193976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.7.151.113
Sep 10 01:23:58 nativespace-cdp sshd[4193976]: Failed password for invalid user andrei from 186.7.151.113 port 55185 ssh2
Sep 10 01:24:02 nativespace-cdp sshd[4193976]: Received disconnect from 186.7.151.113 port 55185:11: Bye Bye [preauth]
Sep 10 01:24:02 nativespace-cdp sshd[4193976]: Disconnected from 186.7.151.113 port 55185 [preauth]
Sep 10 01:26:34 nativespace-cdp sshd[638]: Connection closed by 159.100.136.21 port 46926 [preauth]
Sep 10 01:29:35 nativespace-cdp sshd[1383]: Invalid user penis from 177.115.11.175 port 58865
Sep 10 01:29:35 nativespace-cdp sshd[1383]: input_userauth_request: invalid user penis [preauth]
Sep 10 01:29:35 nativespace-cdp sshd[1383]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 01:29:35 nativespace-cdp sshd[1383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.115.11.175
Sep 10 01:29:37 nativespace-cdp sshd[1383]: Failed password for invalid user penis from 177.115.11.175 port 58865 ssh2
Sep 10 01:29:45 nativespace-cdp sshd[1383]: Received disconnect from 177.115.11.175 port 58865:11: Bye Bye [preauth]
Sep 10 01:29:45 nativespace-cdp sshd[1383]: Disconnected from 177.115.11.175 port 58865 [preauth]
Sep 10 01:31:36 nativespace-cdp sshd[2076]: Connection closed by 159.100.136.21 port 56298 [preauth]
Sep 10 01:32:19 nativespace-cdp sshd[2188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.115.11.175  user=root
Sep 10 01:32:19 nativespace-cdp sshd[2188]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 01:32:22 nativespace-cdp sshd[2188]: Failed password for root from 177.115.11.175 port 58483 ssh2
Sep 10 01:32:24 nativespace-cdp sshd[2188]: Received disconnect from 177.115.11.175 port 58483:11: Bye Bye [preauth]
Sep 10 01:32:24 nativespace-cdp sshd[2188]: Disconnected from 177.115.11.175 port 58483 [preauth]
Sep 10 01:36:33 nativespace-cdp sshd[3093]: Connection closed by 159.100.136.21 port 37880 [preauth]
Sep 10 01:39:32 nativespace-cdp sshd[3708]: Connection closed by 186.7.151.113 port 58339 [preauth]
Sep 10 01:41:33 nativespace-cdp sshd[4354]: Connection closed by 159.100.136.21 port 46958 [preauth]
Sep 10 01:42:25 nativespace-cdp sshd[4679]: Invalid user monkey from 186.7.151.113 port 44988
Sep 10 01:42:25 nativespace-cdp sshd[4679]: input_userauth_request: invalid user monkey [preauth]
Sep 10 01:42:25 nativespace-cdp sshd[4679]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 01:42:25 nativespace-cdp sshd[4679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.7.151.113
Sep 10 01:42:26 nativespace-cdp sshd[4679]: Failed password for invalid user monkey from 186.7.151.113 port 44988 ssh2
Sep 10 01:42:30 nativespace-cdp sshd[4679]: Received disconnect from 186.7.151.113 port 44988:11: Bye Bye [preauth]
Sep 10 01:42:30 nativespace-cdp sshd[4679]: Disconnected from 186.7.151.113 port 44988 [preauth]
Sep 10 01:46:33 nativespace-cdp sshd[5633]: Connection closed by 159.100.136.21 port 56348 [preauth]
Sep 10 01:48:23 nativespace-cdp sshd[5971]: Invalid user farzaneh from 186.7.151.113 port 51135
Sep 10 01:48:23 nativespace-cdp sshd[5971]: input_userauth_request: invalid user farzaneh [preauth]
Sep 10 01:48:23 nativespace-cdp sshd[5971]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 01:48:23 nativespace-cdp sshd[5971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.7.151.113
Sep 10 01:48:25 nativespace-cdp sshd[5971]: Failed password for invalid user farzaneh from 186.7.151.113 port 51135 ssh2
Sep 10 01:51:34 nativespace-cdp sshd[6762]: Connection closed by 159.100.136.21 port 37300 [preauth]
Sep 10 01:56:34 nativespace-cdp sshd[7892]: Connection closed by 159.100.136.21 port 46692 [preauth]
Sep 10 02:01:33 nativespace-cdp sshd[9293]: Connection closed by 159.100.136.21 port 56182 [preauth]
Sep 10 02:06:34 nativespace-cdp sshd[10262]: Connection closed by 159.100.136.21 port 37476 [preauth]
Sep 10 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:57 nativespace-cdp sudo[10874]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:57 nativespace-cdp sudo[10877]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:58 nativespace-cdp sudo[10880]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 02:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:58 nativespace-cdp sudo[10886]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 02:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:59 nativespace-cdp sudo[10889]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 02:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:59 nativespace-cdp sudo[10896]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 02:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:59 nativespace-cdp sudo[10899]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 02:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:59 nativespace-cdp sudo[10903]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 02:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:59 nativespace-cdp sudo[10907]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 02:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:59 nativespace-cdp sudo[10910]: pam_unix(sudo:session): session closed for user root
Sep 10 02:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 02:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:09:59 nativespace-cdp sudo[10913]: pam_unix(sudo:session): session closed for user root
Sep 10 02:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 02:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:10:01 nativespace-cdp sudo[10920]: pam_unix(sudo:session): session closed for user root
Sep 10 02:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 02:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:10:01 nativespace-cdp sudo[10924]: pam_unix(sudo:session): session closed for user root
Sep 10 02:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=opaiscyx user-2=coursemc user-3=firstres user-4=ultbcrra user-5=jonhartl user-6=seftvta user-7=highlegh user-8=southlon user-9=firstred user-10=costestimatorco user-11=firstrel user-12=clarkass user-13=fetch user-14=carsinyo user-15=putterfi user-16=hubmaster user-17=elecleis user-18=milloyco user-19=gilpin user-20=thqkgnbz user-21=connectedshoppin user-22=ianrayne user-23=accooper user-24=oneoarco user-25=battlere user-26=vivienn1 user-27=firstre2 user-28=nstriton user-29=brighto1 user-30=bemadonn user-31=newstoda user-32=belle user-33=ggaaorgu user-34=bedfords user-35=skyfirec user-36=alexadmin user-37=nativene user-38=stuartge user-39=askhform user-40=innovat1 user-41=lbscrmod user-42=maflemin user-43=vantagep user-44=connect9 user-45=athenare user-46=foundation user-47=markward user-48=booff
Sep 10 02:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=theblack user-51=hodgesonweb user-52=spectrum user-53=jarvisin user-54=leereyn1 user-55=stephani user-56=agproduc user-57=still user-58=atestord user-59=sarafoundation user-60=strathar user-61=brmrjxl user-62=lakesan1 user-63=megacards user-64=musorguk user-65=wilsonsw user-66=ptkxhsbt user-67=dickemery123 user-68=martsblo user-69=magichat user-70=hhdugcor user-71=lbhyisi user-72=jennimil user-73=tomandle user-74=david user-75=nbhavers user-76=careers user-77=mcdermos user-78=chrisdal user-79=onlycont user-80=lucy user-81=attlebor user-82=romaldki user-83=branko user-84=ranxterc user-85=outdoorc user-86=hodgsonmail user-87=boldover user-88=nove user-89=crrtipdl user-90=sosevalu user-91=bakery user-92=nvihkvu user-93=havantho user-94=sketchy user-95=cath user-96=what user-97=tstardom user-98=oubpgvbx user-99=design user-100=kategilpin user-101=dancinggardener user-102=stagingerris
Sep 10 02:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ladburyp user-104=sibtoncc user-105=asandcoc user-106=steve user-107=zebrapho user-108=bwppodcast user-109=nsceres user-110=fawcettd user-111=burydropin user-112=dhyana user-113=darkstar user-114=eatspam user-115=beauty user-116=firstre5 user-117=steakbridieme user-118=donnychicago user-119=ctedorgu user-120=philmcph user-121=lkpier user-122=leftie user-123=foods user-124=fortunaz user-125=health2045 user-126=nscdp user-127=putterfc user-128=tigerlet user-129=barbersh user-130=nomistakes user-131=hidden user-132=isleofwi user-133=smrszyqg user-134=cwsocial user-135=paulmca1 user-136=pugwash user-137=howardon user-138=reliable user-139=ninejimm user-140=cathski user-141=cambria1 user-142=courseme user-143=eugincou user-144=hirefootballgame feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 02:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 02:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:10:02 nativespace-cdp sudo[10929]: pam_unix(sudo:session): session closed for user root
Sep 10 02:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 02:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:10:02 nativespace-cdp sudo[11035]: pam_unix(sudo:session): session closed for user root
Sep 10 02:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oFdESKFbLHsSdlnV.~
Sep 10 02:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:10:02 nativespace-cdp sudo[11040]: pam_unix(sudo:session): session closed for user root
Sep 10 02:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oFdESKFbLHsSdlnV.~'
Sep 10 02:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:10:02 nativespace-cdp sudo[11043]: pam_unix(sudo:session): session closed for user root
Sep 10 02:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oFdESKFbLHsSdlnV.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 02:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:10:02 nativespace-cdp sudo[11047]: pam_unix(sudo:session): session closed for user root
Sep 10 02:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 02:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:10:02 nativespace-cdp sudo[11053]: pam_unix(sudo:session): session closed for user root
Sep 10 02:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 02:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 02:10:09 nativespace-cdp sudo[11104]: pam_unix(sudo:session): session closed for user root
Sep 10 02:11:35 nativespace-cdp sshd[11823]: Connection closed by 159.100.136.21 port 46616 [preauth]
Sep 10 02:16:33 nativespace-cdp sshd[12883]: Connection closed by 159.100.136.21 port 56120 [preauth]
Sep 10 02:21:33 nativespace-cdp sshd[13876]: Connection closed by 159.100.136.21 port 37812 [preauth]
Sep 10 02:26:33 nativespace-cdp sshd[15211]: Connection closed by 159.100.136.21 port 48092 [preauth]
Sep 10 02:29:01 nativespace-cdp sshd[15678]: Invalid user x from 45.195.198.124 port 57422
Sep 10 02:29:01 nativespace-cdp sshd[15678]: input_userauth_request: invalid user x [preauth]
Sep 10 02:29:01 nativespace-cdp sshd[15678]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 02:29:01 nativespace-cdp sshd[15678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.195.198.124
Sep 10 02:29:04 nativespace-cdp sshd[15678]: Failed password for invalid user x from 45.195.198.124 port 57422 ssh2
Sep 10 02:29:04 nativespace-cdp sshd[15678]: Received disconnect from 45.195.198.124 port 57422:11: Bye Bye [preauth]
Sep 10 02:29:04 nativespace-cdp sshd[15678]: Disconnected from 45.195.198.124 port 57422 [preauth]
Sep 10 02:30:10 nativespace-cdp sshd[16015]: Invalid user hyper from 45.195.198.124 port 44398
Sep 10 02:30:10 nativespace-cdp sshd[16015]: input_userauth_request: invalid user hyper [preauth]
Sep 10 02:30:10 nativespace-cdp sshd[16015]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 02:30:10 nativespace-cdp sshd[16015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.195.198.124
Sep 10 02:30:12 nativespace-cdp sshd[16015]: Failed password for invalid user hyper from 45.195.198.124 port 44398 ssh2
Sep 10 02:30:13 nativespace-cdp sshd[16015]: Received disconnect from 45.195.198.124 port 44398:11: Bye Bye [preauth]
Sep 10 02:30:13 nativespace-cdp sshd[16015]: Disconnected from 45.195.198.124 port 44398 [preauth]
Sep 10 02:31:04 nativespace-cdp sshd[16229]: Invalid user marcel from 45.195.198.124 port 58350
Sep 10 02:31:04 nativespace-cdp sshd[16229]: input_userauth_request: invalid user marcel [preauth]
Sep 10 02:31:04 nativespace-cdp sshd[16229]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 02:31:04 nativespace-cdp sshd[16229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.195.198.124
Sep 10 02:31:06 nativespace-cdp sshd[16229]: Failed password for invalid user marcel from 45.195.198.124 port 58350 ssh2
Sep 10 02:31:06 nativespace-cdp sshd[16229]: Received disconnect from 45.195.198.124 port 58350:11: Bye Bye [preauth]
Sep 10 02:31:06 nativespace-cdp sshd[16229]: Disconnected from 45.195.198.124 port 58350 [preauth]
Sep 10 02:31:33 nativespace-cdp sshd[16328]: Connection closed by 159.100.136.21 port 58098 [preauth]
Sep 10 02:36:33 nativespace-cdp sshd[17292]: Connection closed by 159.100.136.21 port 40160 [preauth]
Sep 10 02:41:33 nativespace-cdp sshd[18384]: Connection closed by 159.100.136.21 port 50126 [preauth]
Sep 10 02:46:33 nativespace-cdp sshd[19468]: Connection closed by 159.100.136.21 port 59908 [preauth]
Sep 10 02:50:49 nativespace-cdp sshd[20603]: Bad protocol version identification '\003' from 91.238.181.33 port 65437
Sep 10 02:51:33 nativespace-cdp sshd[20708]: Connection closed by 159.100.136.21 port 40360 [preauth]
Sep 10 02:56:33 nativespace-cdp sshd[22080]: Connection closed by 159.100.136.21 port 49194 [preauth]
Sep 10 03:01:33 nativespace-cdp sshd[23248]: Connection closed by 159.100.136.21 port 56878 [preauth]
Sep 10 03:06:33 nativespace-cdp sshd[24239]: Connection closed by 159.100.136.21 port 38280 [preauth]
Sep 10 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:57 nativespace-cdp sudo[24854]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:57 nativespace-cdp sudo[24857]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:58 nativespace-cdp sudo[24860]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:58 nativespace-cdp sudo[24863]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:59 nativespace-cdp sudo[24866]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 03:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:59 nativespace-cdp sudo[24874]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 03:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:59 nativespace-cdp sudo[24877]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 03:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:59 nativespace-cdp sudo[24880]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 03:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:59 nativespace-cdp sudo[24884]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 03:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:59 nativespace-cdp sudo[24887]: pam_unix(sudo:session): session closed for user root
Sep 10 03:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 03:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:09:59 nativespace-cdp sudo[24890]: pam_unix(sudo:session): session closed for user root
Sep 10 03:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 03:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:10:03 nativespace-cdp sudo[25015]: pam_unix(sudo:session): session closed for user root
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 03:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:10:03 nativespace-cdp sudo[25020]: pam_unix(sudo:session): session closed for user root
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nativene user-2=innovat1 user-3=askhform user-4=stuartge user-5=skyfirec user-6=alexadmin user-7=belle user-8=ggaaorgu user-9=newstoda user-10=bemadonn user-11=bedfords user-12=firstre2 user-13=vivienn1 user-14=battlere user-15=oneoarco user-16=brighto1 user-17=nstriton user-18=connectedshoppin user-19=thqkgnbz user-20=accooper user-21=ianrayne user-22=putterfi user-23=hubmaster user-24=carsinyo user-25=fetch user-26=milloyco user-27=gilpin user-28=elecleis user-29=firstred user-30=southlon user-31=highlegh user-32=clarkass user-33=firstrel user-34=costestimatorco user-35=coursemc user-36=opaiscyx user-37=jonhartl user-38=seftvta user-39=ultbcrra user-40=firstres user-41=magichat user-42=lbhyisi user-43=hhdugcor user-44=dickemery123 user-45=ptkxhsbt user-46=martsblo user-47=musorguk
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=wilsonsw user-50=strathar user-51=sarafoundation user-52=atestord user-53=lakesan1 user-54=brmrjxl user-55=stephani user-56=leereyn1 user-57=still user-58=agproduc user-59=spectrum user-60=hodgesonweb user-61=theblack user-62=jarvisin user-63=ulsukarm user-64=athenare user-65=connect9 user-66=vantagep user-67=maflemin user-68=lbscrmod user-69=markward user-70=foundation user-71=booff user-72=design user-73=ladburyp user-74=dancinggardener user-75=stagingerris user-76=kategilpin user-77=cath user-78=sketchy user-79=havantho user-80=nvihkvu user-81=oubpgvbx user-82=tstardom user-83=what user-84=bakery user-85=sosevalu user-86=crrtipdl user-87=boldover user-88=nove user-89=romaldki user-90=ranxterc user-91=outdoorc user-92=hodgsonmail user-93=branko user-94=onlycont user-95=attlebor user-96=lucy user-97=nbhavers user-98=careers user-99=david user-100=chrisdal user-101=mcdermos
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=jennimil user-103=tomandle user-104=eugincou user-105=courseme user-106=hirefootballgame user-107=paulmca1 user-108=pugwash user-109=howardon user-110=cwsocial user-111=cambria1 user-112=cathski user-113=ninejimm user-114=reliable user-115=hidden user-116=nomistakes user-117=barbersh user-118=tigerlet user-119=smrszyqg user-120=isleofwi user-121=lkpier user-122=ctedorgu user-123=philmcph user-124=donnychicago user-125=steakbridieme user-126=firstre5 user-127=putterfc user-128=nscdp user-129=fortunaz user-130=health2045 user-131=leftie user-132=foods user-133=dhyana user-134=beauty user-135=eatspam user-136=darkstar user-137=nsceres user-138=burydropin user-139=fawcettd user-140=steve user-141=bwppodcast user-142=zebrapho user-143=sibtoncc user-144=asandcoc feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 03:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:10:03 nativespace-cdp sudo[25027]: pam_unix(sudo:session): session closed for user root
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 03:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:10:03 nativespace-cdp sudo[25034]: pam_unix(sudo:session): session closed for user root
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-PZK1BDx0JXzME0Nc.~
Sep 10 03:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:10:03 nativespace-cdp sudo[25037]: pam_unix(sudo:session): session closed for user root
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-PZK1BDx0JXzME0Nc.~'
Sep 10 03:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:10:03 nativespace-cdp sudo[25040]: pam_unix(sudo:session): session closed for user root
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-PZK1BDx0JXzME0Nc.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 03:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:10:03 nativespace-cdp sudo[25045]: pam_unix(sudo:session): session closed for user root
Sep 10 03:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 03:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:10:03 nativespace-cdp sudo[25048]: pam_unix(sudo:session): session closed for user root
Sep 10 03:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 03:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 03:10:09 nativespace-cdp sudo[25077]: pam_unix(sudo:session): session closed for user root
Sep 10 03:11:35 nativespace-cdp sshd[25472]: Connection closed by 159.100.136.21 port 47424 [preauth]
Sep 10 03:16:34 nativespace-cdp sshd[26532]: Connection closed by 159.100.136.21 port 56952 [preauth]
Sep 10 03:21:36 nativespace-cdp sshd[27759]: Connection closed by 159.100.136.21 port 37932 [preauth]
Sep 10 03:26:33 nativespace-cdp sshd[29113]: Connection closed by 159.100.136.21 port 46934 [preauth]
Sep 10 03:31:33 nativespace-cdp sshd[30302]: Connection closed by 159.100.136.21 port 56458 [preauth]
Sep 10 03:36:33 nativespace-cdp sshd[31371]: Connection closed by 159.100.136.21 port 37070 [preauth]
Sep 10 03:41:33 nativespace-cdp sshd[32706]: Connection closed by 159.100.136.21 port 45998 [preauth]
Sep 10 03:46:34 nativespace-cdp sshd[34020]: Connection closed by 159.100.136.21 port 55040 [preauth]
Sep 10 03:51:38 nativespace-cdp sshd[35140]: Connection closed by 159.100.136.21 port 35774 [preauth]
Sep 10 03:52:54 nativespace-cdp sshd[35342]: Invalid user xdp from 88.142.46.185 port 46274
Sep 10 03:52:54 nativespace-cdp sshd[35342]: input_userauth_request: invalid user xdp [preauth]
Sep 10 03:52:54 nativespace-cdp sshd[35342]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 03:52:54 nativespace-cdp sshd[35342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.142.46.185
Sep 10 03:52:56 nativespace-cdp sshd[35342]: Failed password for invalid user xdp from 88.142.46.185 port 46274 ssh2
Sep 10 03:52:56 nativespace-cdp sshd[35342]: Received disconnect from 88.142.46.185 port 46274:11: Bye Bye [preauth]
Sep 10 03:52:56 nativespace-cdp sshd[35342]: Disconnected from 88.142.46.185 port 46274 [preauth]
Sep 10 03:54:12 nativespace-cdp sshd[35560]: Invalid user test01 from 88.142.46.185 port 33902
Sep 10 03:54:12 nativespace-cdp sshd[35560]: input_userauth_request: invalid user test01 [preauth]
Sep 10 03:54:12 nativespace-cdp sshd[35560]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 03:54:12 nativespace-cdp sshd[35560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.142.46.185
Sep 10 03:54:14 nativespace-cdp sshd[35560]: Failed password for invalid user test01 from 88.142.46.185 port 33902 ssh2
Sep 10 03:54:14 nativespace-cdp sshd[35560]: Received disconnect from 88.142.46.185 port 33902:11: Bye Bye [preauth]
Sep 10 03:54:14 nativespace-cdp sshd[35560]: Disconnected from 88.142.46.185 port 33902 [preauth]
Sep 10 03:54:50 nativespace-cdp sshd[35744]: Invalid user online from 88.142.46.185 port 46768
Sep 10 03:54:50 nativespace-cdp sshd[35744]: input_userauth_request: invalid user online [preauth]
Sep 10 03:54:50 nativespace-cdp sshd[35744]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 03:54:50 nativespace-cdp sshd[35744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.142.46.185
Sep 10 03:54:52 nativespace-cdp sshd[35744]: Failed password for invalid user online from 88.142.46.185 port 46768 ssh2
Sep 10 03:54:52 nativespace-cdp sshd[35744]: Received disconnect from 88.142.46.185 port 46768:11: Bye Bye [preauth]
Sep 10 03:54:52 nativespace-cdp sshd[35744]: Disconnected from 88.142.46.185 port 46768 [preauth]
Sep 10 03:56:33 nativespace-cdp sshd[36576]: Connection closed by 159.100.136.21 port 45068 [preauth]
Sep 10 04:01:34 nativespace-cdp sshd[37845]: Connection closed by 159.100.136.21 port 54130 [preauth]
Sep 10 04:06:33 nativespace-cdp sshd[38858]: Connection closed by 159.100.136.21 port 33354 [preauth]
Sep 10 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:09:58 nativespace-cdp sudo[39543]: pam_unix(sudo:session): session closed for user root
Sep 10 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:09:58 nativespace-cdp sudo[39547]: pam_unix(sudo:session): session closed for user root
Sep 10 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:09:58 nativespace-cdp sudo[39550]: pam_unix(sudo:session): session closed for user root
Sep 10 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:09:58 nativespace-cdp sudo[39555]: pam_unix(sudo:session): session closed for user root
Sep 10 04:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 04:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:00 nativespace-cdp sudo[39558]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 04:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:00 nativespace-cdp sudo[39569]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 04:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:00 nativespace-cdp sudo[39573]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 04:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:00 nativespace-cdp sudo[39576]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 04:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:00 nativespace-cdp sudo[39579]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 04:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:00 nativespace-cdp sudo[39582]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 04:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:00 nativespace-cdp sudo[39586]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 04:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:02 nativespace-cdp sudo[39677]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 04:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:02 nativespace-cdp sudo[39681]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jennimil user-2=tomandle user-3=careers user-4=nbhavers user-5=david user-6=chrisdal user-7=mcdermos user-8=onlycont user-9=attlebor user-10=lucy user-11=romaldki user-12=ranxterc user-13=outdoorc user-14=hodgsonmail user-15=branko user-16=boldover user-17=nove user-18=bakery user-19=sosevalu user-20=crrtipdl user-21=cath user-22=sketchy user-23=havantho user-24=nvihkvu user-25=oubpgvbx user-26=tstardom user-27=what user-28=design user-29=ladburyp user-30=dancinggardener user-31=stagingerris user-32=kategilpin user-33=asandcoc user-34=sibtoncc user-35=steve user-36=bwppodcast user-37=zebrapho user-38=nsceres user-39=burydropin user-40=fawcettd user-41=dhyana user-42=beauty user-43=eatspam user-44=darkstar user-45=lkpier user-46=philmcph user-47=ctedorgu user-48=steakbridieme user-49=firstre5
Sep 10 04:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=donnychicago user-51=putterfc user-52=nscdp user-53=fortunaz user-54=health2045 user-55=foods user-56=leftie user-57=hidden user-58=nomistakes user-59=tigerlet user-60=barbersh user-61=smrszyqg user-62=isleofwi user-63=pugwash user-64=howardon user-65=paulmca1 user-66=cwsocial user-67=cambria1 user-68=cathski user-69=reliable user-70=ninejimm user-71=eugincou user-72=courseme user-73=hirefootballgame user-74=opaiscyx user-75=coursemc user-76=seftvta user-77=jonhartl user-78=ultbcrra user-79=firstres user-80=firstred user-81=southlon user-82=highlegh user-83=clarkass user-84=firstrel user-85=costestimatorco user-86=hubmaster user-87=putterfi user-88=carsinyo user-89=fetch user-90=milloyco user-91=gilpin user-92=elecleis user-93=connectedshoppin user-94=thqkgnbz user-95=accooper user-96=ianrayne user-97=firstre2 user-98=vivienn1 user-99=battlere user-100=oneoarco user-101=brighto1 user-102=nstriton
Sep 10 04:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ggaaorgu user-104=belle user-105=newstoda user-106=bemadonn user-107=bedfords user-108=alexadmin user-109=skyfirec user-110=nativene user-111=innovat1 user-112=askhform user-113=stuartge user-114=connect9 user-115=athenare user-116=vantagep user-117=maflemin user-118=lbscrmod user-119=markward user-120=booff user-121=foundation user-122=ulsukarm user-123=spectrum user-124=hodgesonweb user-125=theblack user-126=jarvisin user-127=stephani user-128=leereyn1 user-129=still user-130=agproduc user-131=strathar user-132=sarafoundation user-133=atestord user-134=brmrjxl user-135=lakesan1 user-136=musorguk user-137=megacards user-138=wilsonsw user-139=dickemery123 user-140=ptkxhsbt user-141=martsblo user-142=magichat user-143=lbhyisi user-144=hhdugcor feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 04:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 04:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:03 nativespace-cdp sudo[39700]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 04:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:03 nativespace-cdp sudo[39722]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SBepDLHt8dHzVFjW.~
Sep 10 04:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:03 nativespace-cdp sudo[39725]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SBepDLHt8dHzVFjW.~'
Sep 10 04:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:03 nativespace-cdp sudo[39728]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SBepDLHt8dHzVFjW.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 04:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:03 nativespace-cdp sudo[39732]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 04:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:03 nativespace-cdp sudo[39735]: pam_unix(sudo:session): session closed for user root
Sep 10 04:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 04:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:10:05 nativespace-cdp sudo[39808]: pam_unix(sudo:session): session closed for user root
Sep 10 04:11:33 nativespace-cdp sshd[40138]: Connection closed by 159.100.136.21 port 42474 [preauth]
Sep 10 04:16:36 nativespace-cdp sshd[41638]: Connection closed by 159.100.136.21 port 51848 [preauth]
Sep 10 04:21:33 nativespace-cdp sshd[42864]: Connection closed by 159.100.136.21 port 60960 [preauth]
Sep 10 04:26:35 nativespace-cdp sshd[44407]: Connection closed by 159.100.136.21 port 41976 [preauth]
Sep 10 04:31:35 nativespace-cdp sshd[45662]: Connection closed by 159.100.136.21 port 51242 [preauth]
Sep 10 04:36:37 nativespace-cdp sshd[48048]: Connection closed by 159.100.136.21 port 60996 [preauth]
Sep 10 04:41:33 nativespace-cdp sshd[49623]: Connection closed by 159.100.136.21 port 42086 [preauth]
Sep 10 04:51:33 nativespace-cdp sshd[53491]: Connection closed by 159.100.136.21 port 59794 [preauth]
Sep 10 04:56:36 nativespace-cdp sshd[54861]: Connection closed by 159.100.136.21 port 41102 [preauth]
Sep 10 04:57:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 04:57:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:03 nativespace-cdp sudo[54943]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 04:57:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:03 nativespace-cdp sudo[54954]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 04:57:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:07 nativespace-cdp sudo[55051]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=maflemin user-3=lbscrmod user-4=athenare user-5=connect9 user-6=vantagep user-7=booff user-8=markward user-9=foundation user-10=leereyn1 user-11=stephani user-12=still user-13=agproduc user-14=theblack user-15=hodgesonweb user-16=spectrum user-17=jarvisin user-18=musorguk user-19=megacards user-20=wilsonsw user-21=sarafoundation user-22=atestord user-23=strathar user-24=lakesan1 user-25=brmrjxl user-26=magichat user-27=lbhyisi user-28=hhdugcor user-29=ptkxhsbt user-30=dickemery123 user-31=martsblo user-32=southlon user-33=highlegh user-34=firstred user-35=costestimatorco user-36=clarkass user-37=firstrel user-38=coursemc user-39=opaiscyx user-40=firstres user-41=jonhartl user-42=seftvta user-43=ultbcrra user-44=thqkgnbz user-45=connectedshoppin user-46=ianrayne user-47=accooper
Sep 10 04:57:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=carsinyo user-49=fetch user-50=hubmaster user-51=putterfi user-52=elecleis user-53=gilpin user-54=milloyco user-55=bemadonn user-56=ggaaorgu user-57=belle user-58=newstoda user-59=bedfords user-60=battlere user-61=oneoarco user-62=firstre2 user-63=vivienn1 user-64=brighto1 user-65=nstriton user-66=nativene user-67=stuartge user-68=askhform user-69=innovat1 user-70=skyfirec user-71=alexadmin user-72=steve user-73=zebrapho user-74=bwppodcast user-75=asandcoc user-76=sibtoncc user-77=dhyana user-78=eatspam user-79=darkstar user-80=beauty user-81=nsceres user-82=burydropin user-83=fawcettd user-84=tigerlet user-85=barbersh user-86=hidden user-87=nomistakes user-88=smrszyqg user-89=isleofwi user-90=philmcph user-91=ctedorgu user-92=donnychicago user-93=firstre5 user-94=steakbridieme user-95=lkpier user-96=health2045 user-97=fortunaz user-98=leftie user-99=foods user-100=putterfc user-101=nscdp
Sep 10 04:57:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=courseme user-103=eugincou user-104=hirefootballgame user-105=howardon user-106=pugwash user-107=paulmca1 user-108=cwsocial user-109=reliable user-110=ninejimm user-111=cambria1 user-112=cathski user-113=nbhavers user-114=careers user-115=david user-116=mcdermos user-117=chrisdal user-118=jennimil user-119=tomandle user-120=romaldki user-121=branko user-122=ranxterc user-123=hodgsonmail user-124=outdoorc user-125=onlycont user-126=attlebor user-127=lucy user-128=sosevalu user-129=crrtipdl user-130=bakery user-131=boldover user-132=nove user-133=design user-134=kategilpin user-135=ladburyp user-136=dancinggardener user-137=stagingerris user-138=nvihkvu user-139=cath user-140=sketchy user-141=havantho user-142=what user-143=tstardom user-144=oubpgvbx feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 04:57:07 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 04:57:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:08 nativespace-cdp sudo[55056]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 10 04:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:09 nativespace-cdp sudo[55063]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=onlycont --output=json
Sep 10 04:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:10 nativespace-cdp sudo[55068]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 10 04:57:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 04:57:43 nativespace-cdp sudo[55295]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 04:57:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user onlycont --user-current --json
Sep 10 04:57:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:44 nativespace-cdp sudo[55303]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont LangPHP php_get_vhost_versions --output=json
Sep 10 04:57:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:45 nativespace-cdp sudo[55308]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep 10 04:57:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:47 nativespace-cdp sudo[55314]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 10 04:57:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:47 nativespace-cdp sudo[55322]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DomainInfo single_domain_data domain=apexred.com return_https_redirect_status=1 --output=json
Sep 10 04:57:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:49 nativespace-cdp sudo[55335]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep 10 04:57:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:53 nativespace-cdp sudo[55342]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep 10 04:57:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:54 nativespace-cdp sudo[55353]: pam_unix(sudo:session): session closed for user root
Sep 10 04:57:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont Mime list_redirects --output=json
Sep 10 04:57:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:57:54 nativespace-cdp sudo[55360]: pam_unix(sudo:session): session closed for user root
Sep 10 04:58:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DirectoryPrivacy is_directory_protected dir=/home/onlycont/public_html/wp --output=json
Sep 10 04:58:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:58:05 nativespace-cdp sudo[55457]: pam_unix(sudo:session): session closed for user root
Sep 10 04:58:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 10 04:58:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 04:58:08 nativespace-cdp sudo[55515]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 04:58:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 10 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 10 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 10 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:58:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 04:58:08 nativespace-cdp sudo[55521]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 04:58:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 10 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 10 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 10 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:58:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 04:58:10 nativespace-cdp sudo[55528]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 04:58:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 10 04:58:10 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 10 04:58:10 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 10 04:58:10 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:58:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 04:58:11 nativespace-cdp sudo[55536]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 10 04:58:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 04:58:21 nativespace-cdp sudo[55657]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:58:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 04:58:21 nativespace-cdp sudo[55664]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:58:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 04:58:21 nativespace-cdp sudo[55671]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 10 04:58:21 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:58:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 04:58:21 nativespace-cdp sudo[55678]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 04:58:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 10 04:58:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:58:23 nativespace-cdp sudo[55714]: pam_unix(sudo:session): session closed for user root
Sep 10 04:58:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep 10 04:58:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:58:23 nativespace-cdp sudo[55719]: pam_unix(sudo:session): session closed for user root
Sep 10 04:58:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 10 04:58:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 04:58:46 nativespace-cdp sudo[55814]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 04:58:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 10 04:58:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:58:47 nativespace-cdp sudo[55821]: pam_unix(sudo:session): session closed for user root
Sep 10 04:58:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep 10 04:58:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:58:47 nativespace-cdp sudo[55828]: pam_unix(sudo:session): session closed for user root
Sep 10 04:58:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep 10 04:58:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:58:48 nativespace-cdp sudo[55832]: pam_unix(sudo:session): session closed for user root
Sep 10 04:58:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 10 04:58:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:58:48 nativespace-cdp sudo[55840]: pam_unix(sudo:session): session closed for user root
Sep 10 04:58:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep 10 04:58:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:58:51 nativespace-cdp sudo[55859]: pam_unix(sudo:session): session closed for user root
Sep 10 04:58:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep 10 04:58:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:58:51 nativespace-cdp sudo[55865]: pam_unix(sudo:session): session closed for user root
Sep 10 04:59:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep 10 04:59:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:59:00 nativespace-cdp sudo[55962]: pam_unix(sudo:session): session closed for user root
Sep 10 04:59:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 10 04:59:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 04:59:03 nativespace-cdp sudo[56047]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 04:59:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 10 04:59:03 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 10 04:59:03 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 10 04:59:03 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:59:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 04:59:03 nativespace-cdp sudo[56053]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 04:59:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 10 04:59:03 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 10 04:59:03 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 10 04:59:03 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:59:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 04:59:27 nativespace-cdp sudo[56061]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 04:59:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 10 04:59:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 04:59:36 nativespace-cdp sudo[56364]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 04:59:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 10 04:59:36 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 10 04:59:36 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 10 04:59:36 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:59:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 04:59:36 nativespace-cdp sudo[56370]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 04:59:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 10 04:59:36 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 10 04:59:36 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 10 04:59:36 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 04:59:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 04:59:36 nativespace-cdp sudo[56376]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 04:59:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 10 04:59:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:59:39 nativespace-cdp sudo[56434]: pam_unix(sudo:session): session closed for user root
Sep 10 04:59:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep 10 04:59:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:59:39 nativespace-cdp sudo[56445]: pam_unix(sudo:session): session closed for user root
Sep 10 04:59:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 10 04:59:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 04:59:55 nativespace-cdp sudo[56790]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 04:59:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep 10 04:59:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:59:55 nativespace-cdp sudo[56799]: pam_unix(sudo:session): session closed for user root
Sep 10 04:59:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep 10 04:59:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:59:56 nativespace-cdp sudo[56819]: pam_unix(sudo:session): session closed for user root
Sep 10 04:59:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 10 04:59:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:59:56 nativespace-cdp sudo[56835]: pam_unix(sudo:session): session closed for user root
Sep 10 04:59:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep 10 04:59:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:59:57 nativespace-cdp sudo[56873]: pam_unix(sudo:session): session closed for user root
Sep 10 04:59:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep 10 04:59:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 04:59:57 nativespace-cdp sudo[56893]: pam_unix(sudo:session): session closed for user root
Sep 10 05:00:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep 10 05:00:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:00:19 nativespace-cdp sudo[57401]: pam_unix(sudo:session): session closed for user root
Sep 10 05:00:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 10 05:00:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 05:00:23 nativespace-cdp sudo[57498]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 05:00:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 10 05:00:23 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 10 05:00:23 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 10 05:00:23 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:00:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 05:00:23 nativespace-cdp sudo[57509]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 05:00:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 10 05:00:23 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 10 05:00:23 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 10 05:00:23 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:00:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 05:00:42 nativespace-cdp sudo[57528]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 05:00:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 10 05:00:42 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 10 05:00:42 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 10 05:00:42 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:00:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 05:00:44 nativespace-cdp sudo[57911]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 10 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 05:00:52 nativespace-cdp sudo[58128]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 05:00:52 nativespace-cdp sudo[58134]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 05:00:52 nativespace-cdp sudo[58140]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 10 05:00:52 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:00:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 05:00:52 nativespace-cdp sudo[58145]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 10 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:00:54 nativespace-cdp sudo[58182]: pam_unix(sudo:session): session closed for user root
Sep 10 05:00:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep 10 05:00:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:00:54 nativespace-cdp sudo[58188]: pam_unix(sudo:session): session closed for user root
Sep 10 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep 10 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:00:56 nativespace-cdp sudo[58206]: pam_unix(sudo:session): session closed for user root
Sep 10 05:00:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep 10 05:00:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:00:56 nativespace-cdp sudo[58213]: pam_unix(sudo:session): session closed for user root
Sep 10 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 10 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 10 05:00:57 nativespace-cdp sudo[58223]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 10 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep 10 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:00:57 nativespace-cdp sudo[58230]: pam_unix(sudo:session): session closed for user root
Sep 10 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep 10 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:00:58 nativespace-cdp sudo[58238]: pam_unix(sudo:session): session closed for user root
Sep 10 05:00:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 10 05:00:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:00:58 nativespace-cdp sudo[58242]: pam_unix(sudo:session): session closed for user root
Sep 10 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 10 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 05:01:14 nativespace-cdp sudo[58338]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 10 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:01:14 nativespace-cdp sudo[58345]: pam_unix(sudo:session): session closed for user root
Sep 10 05:01:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 10 05:01:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:01:14 nativespace-cdp sudo[58350]: pam_unix(sudo:session): session closed for user root
Sep 10 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep 10 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:01:16 nativespace-cdp sudo[58363]: pam_unix(sudo:session): session closed for user root
Sep 10 05:01:37 nativespace-cdp sshd[58436]: Connection closed by 159.100.136.21 port 50634 [preauth]
Sep 10 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep 10 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:01:39 nativespace-cdp sudo[58483]: pam_unix(sudo:session): session closed for user root
Sep 10 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 10 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 05:01:42 nativespace-cdp sudo[58544]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 05:01:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 10 05:01:42 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 10 05:01:42 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 10 05:01:42 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:01:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 05:01:43 nativespace-cdp sudo[58550]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 05:01:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 10 05:01:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 10 05:01:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 10 05:01:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:01:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 05:02:00 nativespace-cdp sudo[58560]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 05:02:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 10 05:02:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 05:02:06 nativespace-cdp sudo[58711]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 05:02:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 10 05:02:06 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 10 05:02:06 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 10 05:02:06 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:02:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 05:02:06 nativespace-cdp sudo[58718]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 05:02:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 10 05:02:06 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 10 05:02:06 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 10 05:02:06 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 10 05:02:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 05:02:06 nativespace-cdp sudo[58724]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 05:02:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 10 05:02:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:09 nativespace-cdp sudo[58799]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep 10 05:02:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:09 nativespace-cdp sudo[58831]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 10 05:02:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 10 05:02:17 nativespace-cdp sudo[58901]: pam_unix(sudo:session): session closed for user fortunaz
Sep 10 05:02:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep 10 05:02:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:18 nativespace-cdp sudo[58907]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep 10 05:02:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:18 nativespace-cdp sudo[58912]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 10 05:02:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:18 nativespace-cdp sudo[58916]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep 10 05:02:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:21 nativespace-cdp sudo[58931]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep 10 05:02:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:21 nativespace-cdp sudo[58941]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep 10 05:02:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:26 nativespace-cdp sudo[59005]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=ulsukarm WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "Category Order and Taxonomy Terms Order" on ONE | OAR (https://oneoar.co.uk). Installed version: 1.7.9. Available version: 1.8.6.<br/><br/>2. Plugin "Site Kit by Google" on ONE | OAR (https://oneoar.co.uk). Installed version: 1.86.0. Available version: 1.135.0.<br/><br/>3. Plugin "Kadence Blocks – Gutenberg Blocks for Page Builder Features" on Limekilns Heritage Trust (https://limekilnspier.org.uk). Installed version: 3.2.23. Available version: 3.2.53.<br/><br/>4. Plugin "Site Kit by Google" on Limekilns Heritage Trust (https://limekilnspier.org.uk). Installed version: 1.120.0. Available version: 1.135.0.<br/><br/>5. Plugin
Sep 10 05:02:36 nativespace-cdp sudo: wp-toolkit : (command continued) "Category Order and Taxonomy Terms Order" on Pinstripe Inventories (https://pinstripe.services). Installed version: 1.7.9. Available version: 1.8.6.<br/><br/>6. Plugin "Site Kit by Google" on Pinstripe Inventories (https://pinstripe.services). Installed version: 1.115.0. Available version: 1.135.0.<br/><br/>' installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep 10 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:36 nativespace-cdp sudo[59189]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59314]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59318]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59322]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59325]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59328]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59331]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59334]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59337]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59340]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59343]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59346]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59349]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59352]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59355]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59358]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59362]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:43 nativespace-cdp sudo[59365]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59368]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59371]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59375]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59378]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59381]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59384]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59387]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59390]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59393]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59396]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59399]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59402]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59406]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59409]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59412]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59415]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59419]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59422]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59425]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59428]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59431]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59434]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59437]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59440]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59443]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59446]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59449]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59452]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59455]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59458]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59461]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59464]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59467]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:44 nativespace-cdp sudo[59470]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59473]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59476]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59479]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59482]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59485]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59488]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59491]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59494]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59497]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59500]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59503]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59506]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59509]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59512]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59515]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59519]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59522]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59525]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59528]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59531]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59534]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59537]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59540]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59543]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59546]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59549]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59552]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59555]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59558]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:45 nativespace-cdp sudo[59561]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59564]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59567]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59570]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59573]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59576]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59579]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59582]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59585]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59589]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59592]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59595]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59598]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59601]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59604]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59607]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59611]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59614]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59617]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59620]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59623]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59626]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59629]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59632]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59635]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59638]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59641]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59644]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59647]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59650]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59653]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:46 nativespace-cdp sudo[59656]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59659]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59662]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59665]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59668]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59671]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59674]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59677]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59680]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59683]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59686]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59689]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59692]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59695]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59698]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59701]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59704]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59707]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59710]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59713]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59717]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59720]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59723]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59726]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59729]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59732]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59735]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59738]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59741]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59744]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59747]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59750]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59753]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59756]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59759]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59762]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59765]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:47 nativespace-cdp sudo[59768]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59771]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59774]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59777]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59780]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59783]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59786]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59789]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59792]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59795]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59798]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59801]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59804]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59807]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59810]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59813]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59816]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59819]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59822]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59826]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59830]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59833]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59836]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59839]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59842]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59845]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59848]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59852]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59855]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59858]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59861]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59864]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59867]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59871]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:48 nativespace-cdp sudo[59874]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59877]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59880]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59883]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59886]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59889]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59892]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59895]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59898]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59901]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59904]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59907]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59910]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59913]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59916]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59919]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59922]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59925]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59928]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59931]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59935]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59938]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59941]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59944]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59947]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59950]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59953]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59956]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59959]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59962]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59965]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59968]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59971]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59974]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59977]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59980]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:49 nativespace-cdp sudo[59983]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 10 05:02:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:50 nativespace-cdp sudo[59986]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 10 05:02:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:50 nativespace-cdp sudo[59989]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 10 05:02:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:50 nativespace-cdp sudo[59992]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 10 05:02:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:50 nativespace-cdp sudo[59995]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 10 05:02:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:50 nativespace-cdp sudo[59998]: pam_unix(sudo:session): session closed for user root
Sep 10 05:02:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 10 05:02:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:02:50 nativespace-cdp sudo[60001]: pam_unix(sudo:session): session closed for user root
Sep 10 05:03:16 nativespace-cdp sshd[60073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.184.64.158  user=root
Sep 10 05:03:16 nativespace-cdp sshd[60073]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 05:03:18 nativespace-cdp sshd[60073]: Failed password for root from 102.184.64.158 port 60518 ssh2
Sep 10 05:03:20 nativespace-cdp sshd[60073]: Received disconnect from 102.184.64.158 port 60518:11: Bye Bye [preauth]
Sep 10 05:03:20 nativespace-cdp sshd[60073]: Disconnected from 102.184.64.158 port 60518 [preauth]
Sep 10 05:06:34 nativespace-cdp sshd[60737]: Connection closed by 159.100.136.21 port 59840 [preauth]
Sep 10 05:10:00 nativespace-cdp sshd[61352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.219.224.230  user=root
Sep 10 05:10:00 nativespace-cdp sshd[61352]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:03 nativespace-cdp sudo[61476]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:03 nativespace-cdp sudo[61479]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:03 nativespace-cdp sshd[61352]: Failed password for root from 196.219.224.230 port 35716 ssh2
Sep 10 05:10:03 nativespace-cdp sshd[61352]: Received disconnect from 196.219.224.230 port 35716:11: Bye Bye [preauth]
Sep 10 05:10:03 nativespace-cdp sshd[61352]: Disconnected from 196.219.224.230 port 35716 [preauth]
Sep 10 05:10:03 nativespace-cdp sudo[61482]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:03 nativespace-cdp sudo[61490]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 05:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:08 nativespace-cdp sudo[61493]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 05:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:08 nativespace-cdp sudo[61507]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 05:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:08 nativespace-cdp sudo[61511]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 05:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:08 nativespace-cdp sudo[61514]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 05:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:08 nativespace-cdp sudo[61518]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 05:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:08 nativespace-cdp sudo[61521]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 05:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:08 nativespace-cdp sudo[61524]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 05:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:20 nativespace-cdp sudo[61553]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 05:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:20 nativespace-cdp sudo[61557]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bakery user-2=crrtipdl user-3=sosevalu user-4=boldover user-5=nove user-6=design user-7=dancinggardener user-8=stagingerris user-9=ladburyp user-10=kategilpin user-11=havantho user-12=sketchy user-13=cath user-14=nvihkvu user-15=oubpgvbx user-16=tstardom user-17=what user-18=david user-19=careers user-20=nbhavers user-21=chrisdal user-22=mcdermos user-23=jennimil user-24=tomandle user-25=romaldki user-26=outdoorc user-27=hodgsonmail user-28=ranxterc user-29=branko user-30=onlycont user-31=lucy user-32=attlebor user-33=nomistakes user-34=hidden user-35=tigerlet user-36=barbersh user-37=smrszyqg user-38=isleofwi user-39=lkpier user-40=donnychicago user-41=steakbridieme user-42=firstre5 user-43=philmcph user-44=ctedorgu user-45=nscdp user-46=putterfc user-47=foods user-48=leftie user-49=fortunaz
Sep 10 05:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=health2045 user-51=eugincou user-52=courseme user-53=hirefootballgame user-54=cwsocial user-55=paulmca1 user-56=howardon user-57=pugwash user-58=cathski user-59=cambria1 user-60=ninejimm user-61=reliable user-62=steve user-63=bwppodcast user-64=zebrapho user-65=sibtoncc user-66=asandcoc user-67=dhyana user-68=beauty user-69=darkstar user-70=eatspam user-71=nsceres user-72=fawcettd user-73=burydropin user-74=newstoda user-75=belle user-76=ggaaorgu user-77=bemadonn user-78=bedfords user-79=vivienn1 user-80=firstre2 user-81=oneoarco user-82=battlere user-83=nstriton user-84=brighto1 user-85=nativene user-86=innovat1 user-87=askhform user-88=stuartge user-89=alexadmin user-90=skyfirec user-91=firstred user-92=highlegh user-93=southlon user-94=clarkass user-95=firstrel user-96=costestimatorco user-97=coursemc user-98=opaiscyx user-99=ultbcrra user-100=seftvta user-101=jonhartl user-102=firstres
Sep 10 05:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=connectedshoppin user-104=thqkgnbz user-105=accooper user-106=ianrayne user-107=putterfi user-108=hubmaster user-109=fetch user-110=carsinyo user-111=gilpin user-112=milloyco user-113=elecleis user-114=megacards user-115=musorguk user-116=wilsonsw user-117=strathar user-118=atestord user-119=sarafoundation user-120=lakesan1 user-121=brmrjxl user-122=magichat user-123=hhdugcor user-124=lbhyisi user-125=dickemery123 user-126=ptkxhsbt user-127=martsblo user-128=ulsukarm user-129=vantagep user-130=athenare user-131=connect9 user-132=lbscrmod user-133=maflemin user-134=markward user-135=booff user-136=foundation user-137=stephani user-138=leereyn1 user-139=agproduc user-140=still user-141=spectrum user-142=hodgesonweb user-143=theblack user-144=jarvisin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 05:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 05:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:21 nativespace-cdp sudo[61563]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 05:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:21 nativespace-cdp sudo[61568]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FPkmEttheZVDiw4n.~
Sep 10 05:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:21 nativespace-cdp sudo[61572]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FPkmEttheZVDiw4n.~'
Sep 10 05:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:21 nativespace-cdp sudo[61575]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FPkmEttheZVDiw4n.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 05:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:21 nativespace-cdp sudo[61579]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 05:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:21 nativespace-cdp sudo[61584]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 05:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 05:10:23 nativespace-cdp sudo[61613]: pam_unix(sudo:session): session closed for user root
Sep 10 05:10:55 nativespace-cdp sshd[61754]: Invalid user tv from 102.184.64.158 port 42484
Sep 10 05:10:55 nativespace-cdp sshd[61754]: input_userauth_request: invalid user tv [preauth]
Sep 10 05:10:55 nativespace-cdp sshd[61754]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 05:10:55 nativespace-cdp sshd[61754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.184.64.158
Sep 10 05:10:57 nativespace-cdp sshd[61754]: Failed password for invalid user tv from 102.184.64.158 port 42484 ssh2
Sep 10 05:10:57 nativespace-cdp sshd[61754]: Received disconnect from 102.184.64.158 port 42484:11: Bye Bye [preauth]
Sep 10 05:10:57 nativespace-cdp sshd[61754]: Disconnected from 102.184.64.158 port 42484 [preauth]
Sep 10 05:11:33 nativespace-cdp sshd[61980]: Connection closed by 159.100.136.21 port 40616 [preauth]
Sep 10 05:11:50 nativespace-cdp sshd[62015]: Invalid user es from 102.184.64.158 port 59890
Sep 10 05:11:50 nativespace-cdp sshd[62015]: input_userauth_request: invalid user es [preauth]
Sep 10 05:11:50 nativespace-cdp sshd[62015]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 05:11:50 nativespace-cdp sshd[62015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.184.64.158
Sep 10 05:11:51 nativespace-cdp sshd[62015]: Failed password for invalid user es from 102.184.64.158 port 59890 ssh2
Sep 10 05:11:51 nativespace-cdp sshd[62015]: Received disconnect from 102.184.64.158 port 59890:11: Bye Bye [preauth]
Sep 10 05:11:51 nativespace-cdp sshd[62015]: Disconnected from 102.184.64.158 port 59890 [preauth]
Sep 10 05:13:33 nativespace-cdp sshd[62403]: Invalid user sahar from 197.39.5.169 port 51500
Sep 10 05:13:33 nativespace-cdp sshd[62403]: input_userauth_request: invalid user sahar [preauth]
Sep 10 05:13:33 nativespace-cdp sshd[62403]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 05:13:33 nativespace-cdp sshd[62403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.39.5.169
Sep 10 05:13:35 nativespace-cdp sshd[62403]: Failed password for invalid user sahar from 197.39.5.169 port 51500 ssh2
Sep 10 05:13:36 nativespace-cdp sshd[62403]: Received disconnect from 197.39.5.169 port 51500:11: Bye Bye [preauth]
Sep 10 05:13:36 nativespace-cdp sshd[62403]: Disconnected from 197.39.5.169 port 51500 [preauth]
Sep 10 05:14:22 nativespace-cdp sshd[62548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.219.224.230  user=root
Sep 10 05:14:22 nativespace-cdp sshd[62548]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 05:14:25 nativespace-cdp sshd[62548]: Failed password for root from 196.219.224.230 port 49722 ssh2
Sep 10 05:14:25 nativespace-cdp sshd[62548]: Received disconnect from 196.219.224.230 port 49722:11: Bye Bye [preauth]
Sep 10 05:14:25 nativespace-cdp sshd[62548]: Disconnected from 196.219.224.230 port 49722 [preauth]
Sep 10 05:15:34 nativespace-cdp sshd[62865]: Connection closed by 196.219.224.230 port 46684 [preauth]
Sep 10 05:16:37 nativespace-cdp sshd[63143]: Connection closed by 159.100.136.21 port 50178 [preauth]
Sep 10 05:17:52 nativespace-cdp sshd[63411]: Invalid user testssh from 197.39.5.169 port 37190
Sep 10 05:17:52 nativespace-cdp sshd[63411]: input_userauth_request: invalid user testssh [preauth]
Sep 10 05:17:52 nativespace-cdp sshd[63411]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 05:17:52 nativespace-cdp sshd[63411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.39.5.169
Sep 10 05:17:54 nativespace-cdp sshd[63411]: Failed password for invalid user testssh from 197.39.5.169 port 37190 ssh2
Sep 10 05:17:54 nativespace-cdp sshd[63411]: Received disconnect from 197.39.5.169 port 37190:11: Bye Bye [preauth]
Sep 10 05:17:54 nativespace-cdp sshd[63411]: Disconnected from 197.39.5.169 port 37190 [preauth]
Sep 10 05:18:38 nativespace-cdp sshd[63761]: Invalid user ts3server from 197.39.5.169 port 40988
Sep 10 05:18:38 nativespace-cdp sshd[63761]: input_userauth_request: invalid user ts3server [preauth]
Sep 10 05:18:38 nativespace-cdp sshd[63761]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 05:18:38 nativespace-cdp sshd[63761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.39.5.169
Sep 10 05:18:40 nativespace-cdp sshd[63761]: Failed password for invalid user ts3server from 197.39.5.169 port 40988 ssh2
Sep 10 05:18:40 nativespace-cdp sshd[63761]: Received disconnect from 197.39.5.169 port 40988:11: Bye Bye [preauth]
Sep 10 05:18:40 nativespace-cdp sshd[63761]: Disconnected from 197.39.5.169 port 40988 [preauth]
Sep 10 05:19:29 nativespace-cdp sshd[63924]: Invalid user hoster from 196.219.224.230 port 50990
Sep 10 05:19:29 nativespace-cdp sshd[63924]: input_userauth_request: invalid user hoster [preauth]
Sep 10 05:19:29 nativespace-cdp sshd[63924]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 05:19:29 nativespace-cdp sshd[63924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.219.224.230
Sep 10 05:19:31 nativespace-cdp sshd[63924]: Failed password for invalid user hoster from 196.219.224.230 port 50990 ssh2
Sep 10 05:19:31 nativespace-cdp sshd[63924]: Received disconnect from 196.219.224.230 port 50990:11: Bye Bye [preauth]
Sep 10 05:19:31 nativespace-cdp sshd[63924]: Disconnected from 196.219.224.230 port 50990 [preauth]
Sep 10 05:21:34 nativespace-cdp sshd[64417]: Connection closed by 159.100.136.21 port 58794 [preauth]
Sep 10 05:26:36 nativespace-cdp sshd[65655]: Connection closed by 159.100.136.21 port 39650 [preauth]
Sep 10 05:31:33 nativespace-cdp sshd[66816]: Connection closed by 159.100.136.21 port 49130 [preauth]
Sep 10 05:35:11 nativespace-cdp su: pam_unix(su:session): session opened for user hhdugcor by (uid=0)
Sep 10 05:35:11 nativespace-cdp su[67654]: pam_unix(su:session): session closed for user hhdugcor
Sep 10 05:36:38 nativespace-cdp sshd[67903]: Connection closed by 159.100.136.21 port 58632 [preauth]
Sep 10 05:41:36 nativespace-cdp sshd[69033]: Connection closed by 159.100.136.21 port 39542 [preauth]
Sep 10 05:46:34 nativespace-cdp sshd[70381]: Connection closed by 159.100.136.21 port 48666 [preauth]
Sep 10 05:51:33 nativespace-cdp sshd[71380]: Connection closed by 159.100.136.21 port 57570 [preauth]
Sep 10 05:56:35 nativespace-cdp sshd[72815]: Connection closed by 159.100.136.21 port 38884 [preauth]
Sep 10 06:01:37 nativespace-cdp sshd[73948]: Connection closed by 159.100.136.21 port 48094 [preauth]
Sep 10 06:06:33 nativespace-cdp sshd[74935]: Connection closed by 159.100.136.21 port 56528 [preauth]
Sep 10 06:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 06:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:06 nativespace-cdp sudo[75812]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 06:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:06 nativespace-cdp sudo[75815]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 06:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:08 nativespace-cdp sudo[75818]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 06:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:08 nativespace-cdp sudo[75825]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 06:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:11 nativespace-cdp sudo[75828]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 06:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:11 nativespace-cdp sudo[75841]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 06:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:12 nativespace-cdp sudo[75844]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 06:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:12 nativespace-cdp sudo[75847]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 06:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:12 nativespace-cdp sudo[75850]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 06:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:12 nativespace-cdp sudo[75853]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 06:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:12 nativespace-cdp sudo[75857]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 06:10:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:52 nativespace-cdp sudo[75952]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 06:10:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:53 nativespace-cdp sudo[75957]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=darkstar user-2=eatspam user-3=beauty user-4=dhyana user-5=fawcettd user-6=burydropin user-7=nsceres user-8=zebrapho user-9=bwppodcast user-10=steve user-11=asandcoc user-12=sibtoncc user-13=hirefootballgame user-14=courseme user-15=eugincou user-16=ninejimm user-17=reliable user-18=cathski user-19=cambria1 user-20=cwsocial user-21=howardon user-22=pugwash user-23=paulmca1 user-24=isleofwi user-25=smrszyqg user-26=barbersh user-27=tigerlet user-28=nomistakes user-29=hidden user-30=leftie user-31=foods user-32=fortunaz user-33=health2045 user-34=nscdp user-35=putterfc user-36=steakbridieme user-37=donnychicago user-38=firstre5 user-39=philmcph user-40=ctedorgu user-41=lkpier user-42=branko user-43=outdoorc user-44=ranxterc user-45=hodgsonmail user-46=romaldki user-47=lucy user-48=attlebor
Sep 10 06:10:53 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=mcdermos user-51=chrisdal user-52=david user-53=nbhavers user-54=careers user-55=tomandle user-56=jennimil user-57=kategilpin user-58=dancinggardener user-59=stagingerris user-60=ladburyp user-61=design user-62=what user-63=oubpgvbx user-64=tstardom user-65=nvihkvu user-66=havantho user-67=sketchy user-68=cath user-69=crrtipdl user-70=sosevalu user-71=bakery user-72=nove user-73=boldover user-74=agproduc user-75=still user-76=leereyn1 user-77=stephani user-78=jarvisin user-79=theblack user-80=hodgesonweb user-81=spectrum user-82=ulsukarm user-83=markward user-84=booff user-85=foundation user-86=lbscrmod user-87=maflemin user-88=vantagep user-89=athenare user-90=connect9 user-91=hhdugcor user-92=lbhyisi user-93=magichat user-94=martsblo user-95=ptkxhsbt user-96=dickemery123 user-97=wilsonsw user-98=megacards user-99=musorguk user-100=brmrjxl user-101=lakesan1 user-102=atestord
Sep 10 06:10:53 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=sarafoundation user-104=strathar user-105=ianrayne user-106=accooper user-107=thqkgnbz user-108=connectedshoppin user-109=elecleis user-110=milloyco user-111=gilpin user-112=fetch user-113=carsinyo user-114=putterfi user-115=hubmaster user-116=costestimatorco user-117=firstrel user-118=clarkass user-119=highlegh user-120=southlon user-121=firstred user-122=firstres user-123=ultbcrra user-124=seftvta user-125=jonhartl user-126=coursemc user-127=opaiscyx user-128=stuartge user-129=askhform user-130=innovat1 user-131=nativene user-132=alexadmin user-133=skyfirec user-134=bedfords user-135=bemadonn user-136=newstoda user-137=ggaaorgu user-138=belle user-139=nstriton user-140=brighto1 user-141=oneoarco user-142=battlere user-143=vivienn1 user-144=firstre2 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 06:10:53 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 06:10:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:54 nativespace-cdp sudo[75962]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 06:10:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:55 nativespace-cdp sudo[75975]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9CuVWhsGgIYasxuB.~
Sep 10 06:10:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:55 nativespace-cdp sudo[75978]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9CuVWhsGgIYasxuB.~'
Sep 10 06:10:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:55 nativespace-cdp sudo[75981]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9CuVWhsGgIYasxuB.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 06:10:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:55 nativespace-cdp sudo[75985]: pam_unix(sudo:session): session closed for user root
Sep 10 06:10:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 06:10:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:10:55 nativespace-cdp sudo[75988]: pam_unix(sudo:session): session closed for user root
Sep 10 06:11:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 06:11:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:11:02 nativespace-cdp sudo[76082]: pam_unix(sudo:session): session closed for user root
Sep 10 06:11:34 nativespace-cdp sshd[76204]: Connection closed by 159.100.136.21 port 36972 [preauth]
Sep 10 06:16:33 nativespace-cdp sshd[77692]: Connection closed by 159.100.136.21 port 46238 [preauth]
Sep 10 06:20:02 nativespace-cdp sshd[78451]: Invalid user sammy from 161.35.221.197 port 51954
Sep 10 06:20:02 nativespace-cdp sshd[78451]: input_userauth_request: invalid user sammy [preauth]
Sep 10 06:20:02 nativespace-cdp sshd[78451]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 06:20:02 nativespace-cdp sshd[78451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.221.197
Sep 10 06:20:04 nativespace-cdp sshd[78451]: Failed password for invalid user sammy from 161.35.221.197 port 51954 ssh2
Sep 10 06:20:04 nativespace-cdp sshd[78451]: Received disconnect from 161.35.221.197 port 51954:11: Bye Bye [preauth]
Sep 10 06:20:04 nativespace-cdp sshd[78451]: Disconnected from 161.35.221.197 port 51954 [preauth]
Sep 10 06:20:38 nativespace-cdp sshd[78611]: Invalid user sammy from 77.91.84.54 port 42844
Sep 10 06:20:38 nativespace-cdp sshd[78611]: input_userauth_request: invalid user sammy [preauth]
Sep 10 06:20:38 nativespace-cdp sshd[78611]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 06:20:38 nativespace-cdp sshd[78611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.91.84.54
Sep 10 06:20:39 nativespace-cdp sshd[78611]: Failed password for invalid user sammy from 77.91.84.54 port 42844 ssh2
Sep 10 06:20:40 nativespace-cdp sshd[78611]: Received disconnect from 77.91.84.54 port 42844:11: Bye Bye [preauth]
Sep 10 06:20:40 nativespace-cdp sshd[78611]: Disconnected from 77.91.84.54 port 42844 [preauth]
Sep 10 06:20:51 nativespace-cdp sshd[78642]: Invalid user zt from 103.97.203.154 port 34894
Sep 10 06:20:51 nativespace-cdp sshd[78642]: input_userauth_request: invalid user zt [preauth]
Sep 10 06:20:51 nativespace-cdp sshd[78642]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 06:20:51 nativespace-cdp sshd[78642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.203.154
Sep 10 06:20:53 nativespace-cdp sshd[78642]: Failed password for invalid user zt from 103.97.203.154 port 34894 ssh2
Sep 10 06:20:54 nativespace-cdp sshd[78642]: Received disconnect from 103.97.203.154 port 34894:11: Bye Bye [preauth]
Sep 10 06:20:54 nativespace-cdp sshd[78642]: Disconnected from 103.97.203.154 port 34894 [preauth]
Sep 10 06:21:34 nativespace-cdp sshd[78750]: Connection closed by 159.100.136.21 port 55588 [preauth]
Sep 10 06:21:46 nativespace-cdp sshd[78773]: Invalid user kaumudi from 72.167.44.240 port 46054
Sep 10 06:21:46 nativespace-cdp sshd[78773]: input_userauth_request: invalid user kaumudi [preauth]
Sep 10 06:21:46 nativespace-cdp sshd[78773]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 06:21:46 nativespace-cdp sshd[78773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.44.240
Sep 10 06:21:48 nativespace-cdp sshd[78773]: Failed password for invalid user kaumudi from 72.167.44.240 port 46054 ssh2
Sep 10 06:21:48 nativespace-cdp sshd[78773]: Received disconnect from 72.167.44.240 port 46054:11: Bye Bye [preauth]
Sep 10 06:21:48 nativespace-cdp sshd[78773]: Disconnected from 72.167.44.240 port 46054 [preauth]
Sep 10 06:24:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 06:24:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 06:24:02 nativespace-cdp sudo[79248]: pam_unix(sudo:session): session closed for user root
Sep 10 06:26:33 nativespace-cdp sshd[80047]: Connection closed by 159.100.136.21 port 36104 [preauth]
Sep 10 06:27:26 nativespace-cdp sshd[80188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.221.197  user=root
Sep 10 06:27:26 nativespace-cdp sshd[80188]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 06:27:28 nativespace-cdp sshd[80188]: Failed password for root from 161.35.221.197 port 50440 ssh2
Sep 10 06:27:28 nativespace-cdp sshd[80188]: Received disconnect from 161.35.221.197 port 50440:11: Bye Bye [preauth]
Sep 10 06:27:28 nativespace-cdp sshd[80188]: Disconnected from 161.35.221.197 port 50440 [preauth]
Sep 10 06:27:47 nativespace-cdp sshd[80234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.91.84.54  user=root
Sep 10 06:27:47 nativespace-cdp sshd[80234]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 06:27:49 nativespace-cdp sshd[80234]: Failed password for root from 77.91.84.54 port 58672 ssh2
Sep 10 06:27:49 nativespace-cdp sshd[80234]: Received disconnect from 77.91.84.54 port 58672:11: Bye Bye [preauth]
Sep 10 06:27:49 nativespace-cdp sshd[80234]: Disconnected from 77.91.84.54 port 58672 [preauth]
Sep 10 06:27:54 nativespace-cdp sshd[80247]: Invalid user ganesh from 72.167.44.240 port 48232
Sep 10 06:27:54 nativespace-cdp sshd[80247]: input_userauth_request: invalid user ganesh [preauth]
Sep 10 06:27:54 nativespace-cdp sshd[80247]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 06:27:54 nativespace-cdp sshd[80247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.44.240
Sep 10 06:27:56 nativespace-cdp sshd[80247]: Failed password for invalid user ganesh from 72.167.44.240 port 48232 ssh2
Sep 10 06:27:56 nativespace-cdp sshd[80247]: Received disconnect from 72.167.44.240 port 48232:11: Bye Bye [preauth]
Sep 10 06:27:56 nativespace-cdp sshd[80247]: Disconnected from 72.167.44.240 port 48232 [preauth]
Sep 10 06:28:06 nativespace-cdp sshd[80386]: Invalid user guest from 161.35.221.197 port 35116
Sep 10 06:28:06 nativespace-cdp sshd[80386]: input_userauth_request: invalid user guest [preauth]
Sep 10 06:28:06 nativespace-cdp sshd[80386]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 06:28:06 nativespace-cdp sshd[80386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.221.197
Sep 10 06:28:08 nativespace-cdp sshd[80386]: Failed password for invalid user guest from 161.35.221.197 port 35116 ssh2
Sep 10 06:28:09 nativespace-cdp sshd[80386]: Received disconnect from 161.35.221.197 port 35116:11: Bye Bye [preauth]
Sep 10 06:28:09 nativespace-cdp sshd[80386]: Disconnected from 161.35.221.197 port 35116 [preauth]
Sep 10 06:28:30 nativespace-cdp sshd[80481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.91.84.54  user=root
Sep 10 06:28:30 nativespace-cdp sshd[80481]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 06:28:32 nativespace-cdp sshd[80481]: Failed password for root from 77.91.84.54 port 59376 ssh2
Sep 10 06:28:38 nativespace-cdp sshd[80537]: Invalid user abhinav from 72.167.44.240 port 60270
Sep 10 06:28:38 nativespace-cdp sshd[80537]: input_userauth_request: invalid user abhinav [preauth]
Sep 10 06:28:38 nativespace-cdp sshd[80537]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 06:28:38 nativespace-cdp sshd[80537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.44.240
Sep 10 06:28:39 nativespace-cdp sshd[80537]: Failed password for invalid user abhinav from 72.167.44.240 port 60270 ssh2
Sep 10 06:28:39 nativespace-cdp sshd[80537]: Received disconnect from 72.167.44.240 port 60270:11: Bye Bye [preauth]
Sep 10 06:28:39 nativespace-cdp sshd[80537]: Disconnected from 72.167.44.240 port 60270 [preauth]
Sep 10 06:28:59 nativespace-cdp sshd[80637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.203.154  user=root
Sep 10 06:28:59 nativespace-cdp sshd[80637]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 06:29:01 nativespace-cdp sshd[80637]: Failed password for root from 103.97.203.154 port 38514 ssh2
Sep 10 06:29:01 nativespace-cdp sshd[80637]: Received disconnect from 103.97.203.154 port 38514:11: Bye Bye [preauth]
Sep 10 06:29:01 nativespace-cdp sshd[80637]: Disconnected from 103.97.203.154 port 38514 [preauth]
Sep 10 06:30:23 nativespace-cdp sshd[81021]: Received disconnect from 103.97.203.154 port 52878:11: Bye Bye [preauth]
Sep 10 06:30:23 nativespace-cdp sshd[81021]: Disconnected from 103.97.203.154 port 52878 [preauth]
Sep 10 06:30:58 nativespace-cdp sshd[81330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.203.154  user=root
Sep 10 06:30:58 nativespace-cdp sshd[81330]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 06:31:00 nativespace-cdp sshd[81330]: Failed password for root from 103.97.203.154 port 38990 ssh2
Sep 10 06:31:02 nativespace-cdp sshd[81330]: Received disconnect from 103.97.203.154 port 38990:11: Bye Bye [preauth]
Sep 10 06:31:02 nativespace-cdp sshd[81330]: Disconnected from 103.97.203.154 port 38990 [preauth]
Sep 10 06:31:33 nativespace-cdp sshd[81540]: Connection closed by 159.100.136.21 port 45192 [preauth]
Sep 10 06:36:35 nativespace-cdp sshd[82562]: Connection closed by 159.100.136.21 port 53966 [preauth]
Sep 10 06:41:34 nativespace-cdp sshd[83849]: Connection closed by 159.100.136.21 port 34780 [preauth]
Sep 10 06:46:34 nativespace-cdp sshd[85092]: Connection closed by 159.100.136.21 port 44042 [preauth]
Sep 10 06:51:36 nativespace-cdp sshd[86177]: Connection closed by 159.100.136.21 port 53254 [preauth]
Sep 10 06:56:34 nativespace-cdp sshd[87699]: Connection closed by 159.100.136.21 port 34796 [preauth]
Sep 10 07:01:33 nativespace-cdp sshd[88829]: Connection closed by 159.100.136.21 port 43698 [preauth]
Sep 10 07:06:35 nativespace-cdp sshd[89904]: Connection closed by 159.100.136.21 port 53520 [preauth]
Sep 10 07:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 07:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:06 nativespace-cdp sudo[90752]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 07:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:06 nativespace-cdp sudo[90756]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 07:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:07 nativespace-cdp sudo[90759]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 07:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:07 nativespace-cdp sudo[90767]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 07:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:10 nativespace-cdp sudo[90770]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 07:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:10 nativespace-cdp sudo[90827]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 07:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:10 nativespace-cdp sudo[90830]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 07:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:10 nativespace-cdp sudo[90833]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 07:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:10 nativespace-cdp sudo[90836]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 07:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:10 nativespace-cdp sudo[90839]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 07:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:10 nativespace-cdp sudo[90842]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 07:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:20 nativespace-cdp sudo[90870]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 07:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:20 nativespace-cdp sudo[90874]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=gilpin user-2=milloyco user-3=elecleis user-4=hubmaster user-5=putterfi user-6=fetch user-7=carsinyo user-8=accooper user-9=ianrayne user-10=connectedshoppin user-11=thqkgnbz user-12=ultbcrra user-13=seftvta user-14=jonhartl user-15=firstres user-16=opaiscyx user-17=coursemc user-18=firstrel user-19=clarkass user-20=costestimatorco user-21=firstred user-22=highlegh user-23=southlon user-24=alexadmin user-25=skyfirec user-26=innovat1 user-27=stuartge user-28=askhform user-29=nativene user-30=nstriton user-31=brighto1 user-32=vivienn1 user-33=firstre2 user-34=oneoarco user-35=battlere user-36=bedfords user-37=newstoda user-38=belle user-39=ggaaorgu user-40=bemadonn user-41=jarvisin user-42=spectrum user-43=hodgesonweb user-44=theblack user-45=agproduc user-46=still user-47=stephani
Sep 10 07:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=leereyn1 user-49=markward user-50=booff user-51=foundation user-52=vantagep user-53=athenare user-54=connect9 user-55=lbscrmod user-56=maflemin user-57=ulsukarm user-58=martsblo user-59=dickemery123 user-60=ptkxhsbt user-61=hhdugcor user-62=lbhyisi user-63=magichat user-64=lakesan1 user-65=brmrjxl user-66=strathar user-67=atestord user-68=sarafoundation user-69=wilsonsw user-70=megacards user-71=musorguk user-72=lucy user-73=attlebor user-74=onlycont user-75=hodgsonmail user-76=outdoorc user-77=ranxterc user-78=branko user-79=romaldki user-80=tomandle user-81=jennimil user-82=chrisdal user-83=mcdermos user-84=david user-85=nbhavers user-86=careers user-87=oubpgvbx user-88=tstardom user-89=what user-90=havantho user-91=sketchy user-92=cath user-93=nvihkvu user-94=dancinggardener user-95=stagingerris user-96=ladburyp user-97=kategilpin user-98=design user-99=nove user-100=boldover user-101=bakery
Sep 10 07:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=crrtipdl user-103=sosevalu user-104=fawcettd user-105=burydropin user-106=nsceres user-107=beauty user-108=darkstar user-109=eatspam user-110=dhyana user-111=sibtoncc user-112=asandcoc user-113=bwppodcast user-114=zebrapho user-115=steve user-116=cathski user-117=cambria1 user-118=ninejimm user-119=reliable user-120=cwsocial user-121=paulmca1 user-122=pugwash user-123=howardon user-124=hirefootballgame user-125=eugincou user-126=courseme user-127=nscdp user-128=putterfc user-129=leftie user-130=foods user-131=health2045 user-132=fortunaz user-133=lkpier user-134=firstre5 user-135=steakbridieme user-136=donnychicago user-137=ctedorgu user-138=philmcph user-139=smrszyqg user-140=isleofwi user-141=nomistakes user-142=hidden user-143=tigerlet user-144=barbersh feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 10 07:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 07:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:21 nativespace-cdp sudo[90879]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 07:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:21 nativespace-cdp sudo[90885]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GaymXM9yuz2NN3HZ.~
Sep 10 07:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:22 nativespace-cdp sudo[90888]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GaymXM9yuz2NN3HZ.~'
Sep 10 07:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:22 nativespace-cdp sudo[90891]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GaymXM9yuz2NN3HZ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 07:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:22 nativespace-cdp sudo[90896]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 07:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:22 nativespace-cdp sudo[90899]: pam_unix(sudo:session): session closed for user root
Sep 10 07:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 07:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 07:10:23 nativespace-cdp sudo[90923]: pam_unix(sudo:session): session closed for user root
Sep 10 07:11:36 nativespace-cdp sshd[91191]: Connection closed by 159.100.136.21 port 33780 [preauth]
Sep 10 07:16:37 nativespace-cdp sshd[92810]: Connection closed by 159.100.136.21 port 43170 [preauth]
Sep 10 07:21:33 nativespace-cdp sshd[93975]: Connection closed by 159.100.136.21 port 51522 [preauth]
Sep 10 07:26:34 nativespace-cdp sshd[95550]: Connection closed by 159.100.136.21 port 32932 [preauth]
Sep 10 07:31:33 nativespace-cdp sshd[96798]: Connection closed by 159.100.136.21 port 42504 [preauth]
Sep 10 07:36:33 nativespace-cdp sshd[97855]: Connection closed by 159.100.136.21 port 50624 [preauth]
Sep 10 07:41:36 nativespace-cdp sshd[99399]: Connection closed by 159.100.136.21 port 60138 [preauth]
Sep 10 07:46:36 nativespace-cdp sshd[100487]: Connection closed by 159.100.136.21 port 40924 [preauth]
Sep 10 07:51:33 nativespace-cdp sshd[101575]: Connection closed by 159.100.136.21 port 50080 [preauth]
Sep 10 07:56:33 nativespace-cdp sshd[102858]: Connection closed by 159.100.136.21 port 59840 [preauth]
Sep 10 08:01:33 nativespace-cdp sshd[104046]: Connection closed by 159.100.136.21 port 39438 [preauth]
Sep 10 08:06:33 nativespace-cdp sshd[105679]: Connection closed by 159.100.136.21 port 48506 [preauth]
Sep 10 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:09:59 nativespace-cdp sudo[106376]: pam_unix(sudo:session): session closed for user root
Sep 10 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:09:59 nativespace-cdp sudo[106380]: pam_unix(sudo:session): session closed for user root
Sep 10 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:00 nativespace-cdp sudo[106383]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:00 nativespace-cdp sudo[106390]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:06 nativespace-cdp sudo[106393]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:06 nativespace-cdp sudo[106526]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:06 nativespace-cdp sudo[106529]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:06 nativespace-cdp sudo[106532]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:06 nativespace-cdp sudo[106535]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:06 nativespace-cdp sudo[106538]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 08:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:06 nativespace-cdp sudo[106541]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 08:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:10 nativespace-cdp sudo[106559]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 08:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:11 nativespace-cdp sudo[106564]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=opaiscyx user-2=coursemc user-3=firstres user-4=jonhartl user-5=seftvta user-6=ultbcrra user-7=southlon user-8=highlegh user-9=firstred user-10=costestimatorco user-11=firstrel user-12=clarkass user-13=carsinyo user-14=fetch user-15=putterfi user-16=hubmaster user-17=elecleis user-18=gilpin user-19=milloyco user-20=thqkgnbz user-21=connectedshoppin user-22=ianrayne user-23=accooper user-24=battlere user-25=oneoarco user-26=firstre2 user-27=vivienn1 user-28=brighto1 user-29=nstriton user-30=bemadonn user-31=ggaaorgu user-32=belle user-33=newstoda user-34=bedfords user-35=skyfirec user-36=alexadmin user-37=nativene user-38=stuartge user-39=askhform user-40=innovat1 user-41=maflemin user-42=lbscrmod user-43=athenare user-44=connect9 user-45=vantagep user-46=foundation user-47=booff user-48=markward
Sep 10 08:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=hodgesonweb user-51=theblack user-52=spectrum user-53=jarvisin user-54=leereyn1 user-55=stephani user-56=still user-57=agproduc user-58=sarafoundation user-59=atestord user-60=strathar user-61=lakesan1 user-62=brmrjxl user-63=musorguk user-64=megacards user-65=wilsonsw user-66=ptkxhsbt user-67=dickemery123 user-68=martsblo user-69=magichat user-70=lbhyisi user-71=hhdugcor user-72=jennimil user-73=tomandle user-74=nbhavers user-75=careers user-76=david user-77=mcdermos user-78=chrisdal user-79=onlycont user-80=attlebor user-81=lucy user-82=romaldki user-83=branko user-84=outdoorc user-85=hodgsonmail user-86=ranxterc user-87=boldover user-88=nove user-89=sosevalu user-90=crrtipdl user-91=bakery user-92=nvihkvu user-93=cath user-94=sketchy user-95=havantho user-96=what user-97=tstardom user-98=oubpgvbx user-99=design user-100=kategilpin user-101=ladburyp user-102=dancinggardener
Sep 10 08:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=stagingerris user-104=asandcoc user-105=sibtoncc user-106=steve user-107=zebrapho user-108=bwppodcast user-109=nsceres user-110=burydropin user-111=fawcettd user-112=dhyana user-113=eatspam user-114=darkstar user-115=beauty user-116=philmcph user-117=ctedorgu user-118=donnychicago user-119=steakbridieme user-120=firstre5 user-121=lkpier user-122=health2045 user-123=fortunaz user-124=leftie user-125=foods user-126=putterfc user-127=nscdp user-128=barbersh user-129=tigerlet user-130=hidden user-131=nomistakes user-132=isleofwi user-133=smrszyqg user-134=howardon user-135=pugwash user-136=paulmca1 user-137=cwsocial user-138=ninejimm user-139=reliable user-140=cambria1 user-141=cathski user-142=courseme user-143=eugincou user-144=hirefootballgame feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 08:10:11 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 08:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:13 nativespace-cdp sudo[106569]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 08:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:13 nativespace-cdp sudo[106582]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5pPQ5oSRE3Eir5XP.~
Sep 10 08:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:13 nativespace-cdp sudo[106585]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5pPQ5oSRE3Eir5XP.~'
Sep 10 08:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:13 nativespace-cdp sudo[106589]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5pPQ5oSRE3Eir5XP.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 08:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:13 nativespace-cdp sudo[106593]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 08:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:13 nativespace-cdp sudo[106596]: pam_unix(sudo:session): session closed for user root
Sep 10 08:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 08:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 08:10:30 nativespace-cdp sudo[106653]: pam_unix(sudo:session): session closed for user root
Sep 10 08:11:33 nativespace-cdp sshd[107292]: Connection closed by 159.100.136.21 port 56604 [preauth]
Sep 10 08:16:36 nativespace-cdp sshd[108491]: Connection closed by 159.100.136.21 port 37888 [preauth]
Sep 10 08:21:33 nativespace-cdp sshd[109608]: Connection closed by 159.100.136.21 port 46944 [preauth]
Sep 10 08:26:33 nativespace-cdp sshd[110800]: Connection closed by 159.100.136.21 port 56038 [preauth]
Sep 10 08:31:33 nativespace-cdp sshd[112202]: Connection closed by 159.100.136.21 port 36802 [preauth]
Sep 10 08:36:35 nativespace-cdp sshd[113567]: Connection closed by 159.100.136.21 port 46536 [preauth]
Sep 10 08:46:33 nativespace-cdp sshd[116437]: Connection closed by 159.100.136.21 port 35778 [preauth]
Sep 10 08:51:33 nativespace-cdp sshd[117583]: Connection closed by 159.100.136.21 port 45252 [preauth]
Sep 10 08:56:33 nativespace-cdp sshd[118971]: Connection closed by 159.100.136.21 port 54920 [preauth]
Sep 10 09:01:33 nativespace-cdp sshd[120478]: Connection closed by 159.100.136.21 port 36370 [preauth]
Sep 10 09:06:33 nativespace-cdp sshd[121952]: Connection closed by 159.100.136.21 port 46196 [preauth]
Sep 10 09:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 09:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:11 nativespace-cdp sudo[122842]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 09:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:11 nativespace-cdp sudo[122845]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 09:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:12 nativespace-cdp sudo[122850]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 09:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:12 nativespace-cdp sudo[122905]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 09:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:18 nativespace-cdp sudo[122911]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 09:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:18 nativespace-cdp sudo[122932]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 09:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:18 nativespace-cdp sudo[122937]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 09:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:18 nativespace-cdp sudo[122941]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 09:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:18 nativespace-cdp sudo[122946]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 09:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:18 nativespace-cdp sudo[122952]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 09:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:18 nativespace-cdp sudo[122957]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 09:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:26 nativespace-cdp sudo[122987]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 09:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:28 nativespace-cdp sudo[122995]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nomistakes user-2=hidden user-3=barbersh user-4=tigerlet user-5=smrszyqg user-6=isleofwi user-7=lkpier user-8=firstre5 user-9=donnychicago user-10=steakbridieme user-11=philmcph user-12=ctedorgu user-13=nscdp user-14=putterfc user-15=foods user-16=leftie user-17=fortunaz user-18=health2045 user-19=eugincou user-20=courseme user-21=hirefootballgame user-22=cwsocial user-23=paulmca1 user-24=howardon user-25=pugwash user-26=cathski user-27=cambria1 user-28=ninejimm user-29=reliable user-30=steve user-31=bwppodcast user-32=zebrapho user-33=sibtoncc user-34=asandcoc user-35=dhyana user-36=beauty user-37=darkstar user-38=eatspam user-39=nsceres user-40=fawcettd user-41=burydropin user-42=bakery user-43=crrtipdl user-44=sosevalu user-45=boldover user-46=nove user-47=design user-48=stagingerris
Sep 10 09:10:28 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=dancinggardener user-50=ladburyp user-51=kategilpin user-52=havantho user-53=cath user-54=sketchy user-55=nvihkvu user-56=oubpgvbx user-57=tstardom user-58=what user-59=david user-60=careers user-61=nbhavers user-62=chrisdal user-63=mcdermos user-64=jennimil user-65=tomandle user-66=romaldki user-67=outdoorc user-68=ranxterc user-69=hodgsonmail user-70=branko user-71=onlycont user-72=lucy user-73=attlebor user-74=megacards user-75=musorguk user-76=wilsonsw user-77=strathar user-78=atestord user-79=sarafoundation user-80=lakesan1 user-81=brmrjxl user-82=magichat user-83=hhdugcor user-84=lbhyisi user-85=dickemery123 user-86=ptkxhsbt user-87=martsblo user-88=ulsukarm user-89=vantagep user-90=connect9 user-91=athenare user-92=lbscrmod user-93=maflemin user-94=markward user-95=booff user-96=foundation user-97=stephani user-98=leereyn1 user-99=agproduc user-100=still user-101=spectrum user-102=hodgesonweb
Sep 10 09:10:28 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=theblack user-104=jarvisin user-105=newstoda user-106=belle user-107=ggaaorgu user-108=bemadonn user-109=bedfords user-110=vivienn1 user-111=firstre2 user-112=oneoarco user-113=battlere user-114=nstriton user-115=brighto1 user-116=nativene user-117=innovat1 user-118=stuartge user-119=askhform user-120=skyfirec user-121=alexadmin user-122=firstred user-123=highlegh user-124=southlon user-125=firstrel user-126=clarkass user-127=costestimatorco user-128=coursemc user-129=opaiscyx user-130=ultbcrra user-131=jonhartl user-132=seftvta user-133=firstres user-134=connectedshoppin user-135=thqkgnbz user-136=accooper user-137=ianrayne user-138=hubmaster user-139=putterfi user-140=fetch user-141=carsinyo user-142=milloyco user-143=gilpin user-144=elecleis feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 09:10:28 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 09:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:29 nativespace-cdp sudo[123009]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 09:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:30 nativespace-cdp sudo[123015]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ykaUTMDj7W9b5E4r.~
Sep 10 09:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:30 nativespace-cdp sudo[123020]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ykaUTMDj7W9b5E4r.~'
Sep 10 09:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:30 nativespace-cdp sudo[123024]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ykaUTMDj7W9b5E4r.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 09:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:30 nativespace-cdp sudo[123031]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 09:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:30 nativespace-cdp sudo[123036]: pam_unix(sudo:session): session closed for user root
Sep 10 09:10:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 09:10:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 09:10:49 nativespace-cdp sudo[123122]: pam_unix(sudo:session): session closed for user root
Sep 10 09:11:34 nativespace-cdp sshd[123570]: Connection closed by 159.100.136.21 port 54908 [preauth]
Sep 10 09:16:37 nativespace-cdp sshd[124890]: Connection closed by 159.100.136.21 port 36154 [preauth]
Sep 10 09:21:33 nativespace-cdp sshd[126257]: Connection closed by 159.100.136.21 port 45816 [preauth]
Sep 10 09:26:33 nativespace-cdp sshd[127613]: Connection closed by 159.100.136.21 port 55172 [preauth]
Sep 10 09:31:36 nativespace-cdp sshd[129182]: Connection closed by 159.100.136.21 port 36280 [preauth]
Sep 10 09:36:34 nativespace-cdp sshd[130616]: Connection closed by 159.100.136.21 port 44932 [preauth]
Sep 10 09:41:33 nativespace-cdp sshd[132445]: Connection closed by 159.100.136.21 port 54360 [preauth]
Sep 10 09:46:33 nativespace-cdp sshd[133902]: Connection closed by 159.100.136.21 port 35638 [preauth]
Sep 10 09:51:33 nativespace-cdp sshd[135130]: Connection closed by 159.100.136.21 port 45300 [preauth]
Sep 10 09:56:34 nativespace-cdp sshd[136552]: Connection closed by 159.100.136.21 port 54994 [preauth]
Sep 10 10:01:34 nativespace-cdp sshd[138213]: Connection closed by 159.100.136.21 port 35748 [preauth]
Sep 10 10:06:33 nativespace-cdp sshd[139586]: Connection closed by 159.100.136.21 port 44432 [preauth]
Sep 10 10:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 10:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:04 nativespace-cdp sudo[140501]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 10:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:04 nativespace-cdp sudo[140504]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 10:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:06 nativespace-cdp sudo[140507]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:06 nativespace-cdp sudo[140532]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:10 nativespace-cdp sudo[140535]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 10:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:10 nativespace-cdp sudo[140547]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 10:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:10 nativespace-cdp sudo[140550]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 10:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:10 nativespace-cdp sudo[140553]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 10:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:10 nativespace-cdp sudo[140557]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 10:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:10 nativespace-cdp sudo[140560]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 10:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:10 nativespace-cdp sudo[140563]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 10:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:13 nativespace-cdp sudo[140584]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 10:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:14 nativespace-cdp sudo[140589]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ninejimm user-2=reliable user-3=cambria1 user-4=cathski user-5=cwsocial user-6=pugwash user-7=howardon user-8=paulmca1 user-9=hirefootballgame user-10=courseme user-11=eugincou user-12=foods user-13=leftie user-14=health2045 user-15=fortunaz user-16=nscdp user-17=putterfc user-18=donnychicago user-19=steakbridieme user-20=firstre5 user-21=philmcph user-22=ctedorgu user-23=lkpier user-24=isleofwi user-25=smrszyqg user-26=barbersh user-27=tigerlet user-28=nomistakes user-29=hidden user-30=fawcettd user-31=burydropin user-32=nsceres user-33=darkstar user-34=eatspam user-35=beauty user-36=dhyana user-37=sibtoncc user-38=asandcoc user-39=zebrapho user-40=bwppodcast user-41=steve user-42=what user-43=oubpgvbx user-44=tstardom user-45=nvihkvu user-46=havantho user-47=cath user-48=sketchy
Sep 10 10:10:14 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=kategilpin user-50=stagingerris user-51=dancinggardener user-52=ladburyp user-53=design user-54=nove user-55=boldover user-56=crrtipdl user-57=sosevalu user-58=bakery user-59=lucy user-60=attlebor user-61=onlycont user-62=branko user-63=ranxterc user-64=hodgsonmail user-65=outdoorc user-66=romaldki user-67=tomandle user-68=jennimil user-69=mcdermos user-70=chrisdal user-71=david user-72=nbhavers user-73=careers user-74=martsblo user-75=ptkxhsbt user-76=dickemery123 user-77=hhdugcor user-78=lbhyisi user-79=magichat user-80=lakesan1 user-81=brmrjxl user-82=atestord user-83=sarafoundation user-84=strathar user-85=wilsonsw user-86=megacards user-87=musorguk user-88=jarvisin user-89=theblack user-90=hodgesonweb user-91=spectrum user-92=agproduc user-93=still user-94=leereyn1 user-95=stephani user-96=booff user-97=foundation user-98=markward user-99=lbscrmod user-100=maflemin user-101=vantagep user-102=connect9
Sep 10 10:10:14 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=athenare user-104=ulsukarm user-105=alexadmin user-106=skyfirec user-107=stuartge user-108=askhform user-109=innovat1 user-110=nativene user-111=nstriton user-112=brighto1 user-113=oneoarco user-114=battlere user-115=vivienn1 user-116=firstre2 user-117=bedfords user-118=bemadonn user-119=newstoda user-120=ggaaorgu user-121=belle user-122=elecleis user-123=milloyco user-124=gilpin user-125=fetch user-126=carsinyo user-127=hubmaster user-128=putterfi user-129=ianrayne user-130=accooper user-131=thqkgnbz user-132=connectedshoppin user-133=firstres user-134=ultbcrra user-135=seftvta user-136=jonhartl user-137=coursemc user-138=opaiscyx user-139=costestimatorco user-140=firstrel user-141=clarkass user-142=highlegh user-143=southlon user-144=firstred feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 10:10:14 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 10:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:15 nativespace-cdp sudo[140598]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 10:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:16 nativespace-cdp sudo[140603]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-zqeDlsIBXhpjaqIE.~
Sep 10 10:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:16 nativespace-cdp sudo[140607]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-zqeDlsIBXhpjaqIE.~'
Sep 10 10:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:16 nativespace-cdp sudo[140610]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-zqeDlsIBXhpjaqIE.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 10:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:16 nativespace-cdp sudo[140614]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 10:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:16 nativespace-cdp sudo[140617]: pam_unix(sudo:session): session closed for user root
Sep 10 10:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 10:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 10:10:22 nativespace-cdp sudo[140652]: pam_unix(sudo:session): session closed for user root
Sep 10 10:11:33 nativespace-cdp sshd[140979]: Connection closed by 159.100.136.21 port 53828 [preauth]
Sep 10 10:16:33 nativespace-cdp sshd[142474]: Connection closed by 159.100.136.21 port 34468 [preauth]
Sep 10 10:21:34 nativespace-cdp sshd[143865]: Connection closed by 159.100.136.21 port 42608 [preauth]
Sep 10 10:26:33 nativespace-cdp sshd[145418]: Connection closed by 159.100.136.21 port 51226 [preauth]
Sep 10 10:31:33 nativespace-cdp sshd[146885]: Connection closed by 159.100.136.21 port 59078 [preauth]
Sep 10 10:36:33 nativespace-cdp sshd[148124]: Connection closed by 159.100.136.21 port 39674 [preauth]
Sep 10 10:41:33 nativespace-cdp sshd[149753]: Connection closed by 159.100.136.21 port 49476 [preauth]
Sep 10 10:46:33 nativespace-cdp sshd[151245]: Connection closed by 159.100.136.21 port 59028 [preauth]
Sep 10 10:51:33 nativespace-cdp sshd[152580]: Connection closed by 159.100.136.21 port 40498 [preauth]
Sep 10 10:56:34 nativespace-cdp sshd[153863]: Connection closed by 159.100.136.21 port 50222 [preauth]
Sep 10 11:01:33 nativespace-cdp sshd[155517]: Connection closed by 159.100.136.21 port 59330 [preauth]
Sep 10 11:06:36 nativespace-cdp sshd[156930]: Connection closed by 159.100.136.21 port 40150 [preauth]
Sep 10 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:12 nativespace-cdp sudo[157853]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:12 nativespace-cdp sudo[157856]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 11:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:14 nativespace-cdp sudo[157859]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 11:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:14 nativespace-cdp sudo[157871]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 11:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:21 nativespace-cdp sudo[157874]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 11:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:21 nativespace-cdp sudo[157921]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 11:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:21 nativespace-cdp sudo[157925]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 11:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:21 nativespace-cdp sudo[157928]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 11:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:21 nativespace-cdp sudo[157931]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 11:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:21 nativespace-cdp sudo[157934]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 11:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:21 nativespace-cdp sudo[157937]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 11:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:29 nativespace-cdp sudo[157957]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 11:10:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:30 nativespace-cdp sudo[157961]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bakery user-2=sosevalu user-3=crrtipdl user-4=nove user-5=boldover user-6=ladburyp user-7=stagingerris user-8=dancinggardener user-9=kategilpin user-10=design user-11=oubpgvbx user-12=tstardom user-13=what user-14=cath user-15=sketchy user-16=havantho user-17=nvihkvu user-18=chrisdal user-19=mcdermos user-20=careers user-21=nbhavers user-22=david user-23=tomandle user-24=jennimil user-25=outdoorc user-26=ranxterc user-27=hodgsonmail user-28=branko user-29=romaldki user-30=attlebor user-31=lucy user-32=onlycont user-33=isleofwi user-34=smrszyqg user-35=hidden user-36=nomistakes user-37=barbersh user-38=tigerlet user-39=putterfc user-40=nscdp user-41=health2045 user-42=fortunaz user-43=foods user-44=leftie user-45=lkpier user-46=philmcph user-47=ctedorgu user-48=steakbridieme user-49=donnychicago
Sep 10 11:10:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=firstre5 user-51=hirefootballgame user-52=eugincou user-53=courseme user-54=cambria1 user-55=cathski user-56=reliable user-57=ninejimm user-58=pugwash user-59=howardon user-60=paulmca1 user-61=cwsocial user-62=bwppodcast user-63=zebrapho user-64=steve user-65=sibtoncc user-66=asandcoc user-67=beauty user-68=eatspam user-69=darkstar user-70=dhyana user-71=burydropin user-72=fawcettd user-73=nsceres user-74=bedfords user-75=belle user-76=ggaaorgu user-77=newstoda user-78=bemadonn user-79=brighto1 user-80=nstriton user-81=firstre2 user-82=vivienn1 user-83=battlere user-84=oneoarco user-85=innovat1 user-86=stuartge user-87=askhform user-88=nativene user-89=skyfirec user-90=alexadmin user-91=firstrel user-92=clarkass user-93=costestimatorco user-94=firstred user-95=southlon user-96=highlegh user-97=seftvta user-98=jonhartl user-99=ultbcrra user-100=firstres user-101=opaiscyx user-102=coursemc user-103=accooper
Sep 10 11:10:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=ianrayne user-105=connectedshoppin user-106=thqkgnbz user-107=gilpin user-108=milloyco user-109=elecleis user-110=hubmaster user-111=putterfi user-112=carsinyo user-113=fetch user-114=wilsonsw user-115=musorguk user-116=megacards user-117=lakesan1 user-118=brmrjxl user-119=strathar user-120=sarafoundation user-121=atestord user-122=lbhyisi user-123=hhdugcor user-124=magichat user-125=martsblo user-126=dickemery123 user-127=ptkxhsbt user-128=ulsukarm user-129=booff user-130=foundation user-131=markward user-132=connect9 user-133=athenare user-134=vantagep user-135=maflemin user-136=lbscrmod user-137=still user-138=agproduc user-139=stephani user-140=leereyn1 user-141=jarvisin user-142=spectrum user-143=theblack user-144=hodgesonweb feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains feature-9=webprotect
Sep 10 11:10:30 nativespace-cdp sudo: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 11:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:31 nativespace-cdp sudo[157967]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 10 11:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:33 nativespace-cdp sudo[157979]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep 10 11:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 10 11:10:33 nativespace-cdp sudo[157985]: pam_unix(sudo:session): session closed for user onlycont
Sep 10 11:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 10 11:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:34 nativespace-cdp sudo[157996]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 10 11:10:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 11:10:34 nativespace-cdp sudo[158001]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 11:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 10 11:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:36 nativespace-cdp sudo[158021]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep 10 11:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 10 11:10:36 nativespace-cdp sudo[158030]: pam_unix(sudo:session): session closed for user lkpier
Sep 10 11:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 10 11:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:37 nativespace-cdp sudo[158042]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep 10 11:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 10 11:10:37 nativespace-cdp sudo[158049]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 10 11:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 10 11:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 10 11:10:38 nativespace-cdp sudo[158061]: pam_unix(sudo:session): session closed for user oneoarco
Sep 10 11:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 10 11:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:38 nativespace-cdp sudo[158074]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep 10 11:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 10 11:10:38 nativespace-cdp sudo[158079]: pam_unix(sudo:session): session closed for user fortunaz
Sep 10 11:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep 10 11:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:39 nativespace-cdp sudo[158091]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 11:10:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:39 nativespace-cdp sudo[158095]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep 10 11:10:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:56 nativespace-cdp sudo[159092]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep 10 11:10:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:56 nativespace-cdp sudo[159098]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 11:10:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:58 nativespace-cdp sudo[159109]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1AZ6wVj2awfkzFC8.~
Sep 10 11:10:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:58 nativespace-cdp sudo[159115]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1AZ6wVj2awfkzFC8.~'
Sep 10 11:10:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:58 nativespace-cdp sudo[159119]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1AZ6wVj2awfkzFC8.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 11:10:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:58 nativespace-cdp sudo[159125]: pam_unix(sudo:session): session closed for user root
Sep 10 11:10:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 11:10:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:10:58 nativespace-cdp sudo[159131]: pam_unix(sudo:session): session closed for user root
Sep 10 11:11:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 11:11:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 11:11:04 nativespace-cdp sudo[159183]: pam_unix(sudo:session): session closed for user root
Sep 10 11:11:26 nativespace-cdp sshd[159251]: Accepted publickey for root from 185.67.178.249 port 55582 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep 10 11:11:26 nativespace-cdp sshd[159251]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep 10 11:11:34 nativespace-cdp sshd[159339]: Connection closed by 159.100.136.21 port 48852 [preauth]
Sep 10 11:16:37 nativespace-cdp sshd[160898]: Connection closed by 159.100.136.21 port 57760 [preauth]
Sep 10 11:21:36 nativespace-cdp sshd[162187]: Connection closed by 159.100.136.21 port 39012 [preauth]
Sep 10 11:23:38 nativespace-cdp sshd[162704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.245.91.51  user=root
Sep 10 11:23:38 nativespace-cdp sshd[162704]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 11:23:41 nativespace-cdp sshd[162704]: Failed password for root from 172.245.91.51 port 36254 ssh2
Sep 10 11:23:41 nativespace-cdp sshd[162704]: Received disconnect from 172.245.91.51 port 36254:11: Bye Bye [preauth]
Sep 10 11:23:41 nativespace-cdp sshd[162704]: Disconnected from 172.245.91.51 port 36254 [preauth]
Sep 10 11:24:17 nativespace-cdp sshd[162873]: Invalid user ma from 209.38.24.31 port 48064
Sep 10 11:24:17 nativespace-cdp sshd[162873]: input_userauth_request: invalid user ma [preauth]
Sep 10 11:24:17 nativespace-cdp sshd[162873]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 11:24:17 nativespace-cdp sshd[162873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.24.31
Sep 10 11:24:19 nativespace-cdp sshd[162873]: Failed password for invalid user ma from 209.38.24.31 port 48064 ssh2
Sep 10 11:24:19 nativespace-cdp sshd[162873]: Received disconnect from 209.38.24.31 port 48064:11: Bye Bye [preauth]
Sep 10 11:24:19 nativespace-cdp sshd[162873]: Disconnected from 209.38.24.31 port 48064 [preauth]
Sep 10 11:26:33 nativespace-cdp sshd[163486]: Connection closed by 159.100.136.21 port 47672 [preauth]
Sep 10 11:29:26 nativespace-cdp sshd[164159]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.27.56  user=root
Sep 10 11:29:26 nativespace-cdp sshd[164159]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 11:29:28 nativespace-cdp sshd[164159]: Failed password for root from 134.209.27.56 port 39738 ssh2
Sep 10 11:29:28 nativespace-cdp sshd[164159]: Received disconnect from 134.209.27.56 port 39738:11: Bye Bye [preauth]
Sep 10 11:29:28 nativespace-cdp sshd[164159]: Disconnected from 134.209.27.56 port 39738 [preauth]
Sep 10 11:29:59 nativespace-cdp sshd[164245]: Invalid user rftest from 209.38.24.31 port 40656
Sep 10 11:29:59 nativespace-cdp sshd[164245]: input_userauth_request: invalid user rftest [preauth]
Sep 10 11:29:59 nativespace-cdp sshd[164245]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 11:29:59 nativespace-cdp sshd[164245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.24.31
Sep 10 11:30:01 nativespace-cdp sshd[164245]: Failed password for invalid user rftest from 209.38.24.31 port 40656 ssh2
Sep 10 11:30:01 nativespace-cdp sshd[164245]: Received disconnect from 209.38.24.31 port 40656:11: Bye Bye [preauth]
Sep 10 11:30:01 nativespace-cdp sshd[164245]: Disconnected from 209.38.24.31 port 40656 [preauth]
Sep 10 11:30:43 nativespace-cdp sshd[164677]: Invalid user vip from 172.245.91.51 port 54840
Sep 10 11:30:43 nativespace-cdp sshd[164677]: input_userauth_request: invalid user vip [preauth]
Sep 10 11:30:43 nativespace-cdp sshd[164677]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 11:30:43 nativespace-cdp sshd[164677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.245.91.51
Sep 10 11:30:45 nativespace-cdp sshd[164677]: Failed password for invalid user vip from 172.245.91.51 port 54840 ssh2
Sep 10 11:30:45 nativespace-cdp sshd[164677]: Received disconnect from 172.245.91.51 port 54840:11: Bye Bye [preauth]
Sep 10 11:30:45 nativespace-cdp sshd[164677]: Disconnected from 172.245.91.51 port 54840 [preauth]
Sep 10 11:31:02 nativespace-cdp sshd[164905]: Invalid user user6 from 134.209.27.56 port 58974
Sep 10 11:31:02 nativespace-cdp sshd[164905]: input_userauth_request: invalid user user6 [preauth]
Sep 10 11:31:02 nativespace-cdp sshd[164905]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 11:31:02 nativespace-cdp sshd[164905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.27.56
Sep 10 11:31:05 nativespace-cdp sshd[164905]: Failed password for invalid user user6 from 134.209.27.56 port 58974 ssh2
Sep 10 11:31:06 nativespace-cdp sshd[164905]: Received disconnect from 134.209.27.56 port 58974:11: Bye Bye [preauth]
Sep 10 11:31:06 nativespace-cdp sshd[164905]: Disconnected from 134.209.27.56 port 58974 [preauth]
Sep 10 11:31:07 nativespace-cdp sshd[164904]: Connection closed by 209.38.24.31 port 49920 [preauth]
Sep 10 11:31:24 nativespace-cdp sshd[164962]: Invalid user adminuser from 172.245.91.51 port 36318
Sep 10 11:31:24 nativespace-cdp sshd[164962]: input_userauth_request: invalid user adminuser [preauth]
Sep 10 11:31:24 nativespace-cdp sshd[164962]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 11:31:24 nativespace-cdp sshd[164962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.245.91.51
Sep 10 11:31:26 nativespace-cdp sshd[164962]: Failed password for invalid user adminuser from 172.245.91.51 port 36318 ssh2
Sep 10 11:31:29 nativespace-cdp sshd[164962]: Received disconnect from 172.245.91.51 port 36318:11: Bye Bye [preauth]
Sep 10 11:31:29 nativespace-cdp sshd[164962]: Disconnected from 172.245.91.51 port 36318 [preauth]
Sep 10 11:31:33 nativespace-cdp sshd[164991]: Connection closed by 159.100.136.21 port 56542 [preauth]
Sep 10 11:31:44 nativespace-cdp sshd[165038]: Invalid user serv from 134.209.27.56 port 43964
Sep 10 11:31:44 nativespace-cdp sshd[165038]: input_userauth_request: invalid user serv [preauth]
Sep 10 11:31:44 nativespace-cdp sshd[165038]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 11:31:44 nativespace-cdp sshd[165038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.27.56
Sep 10 11:31:45 nativespace-cdp sshd[165038]: Failed password for invalid user serv from 134.209.27.56 port 43964 ssh2
Sep 10 11:32:00 nativespace-cdp sshd[165120]: Invalid user gitadmin from 209.38.24.31 port 57258
Sep 10 11:32:00 nativespace-cdp sshd[165120]: input_userauth_request: invalid user gitadmin [preauth]
Sep 10 11:32:00 nativespace-cdp sshd[165120]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 11:32:00 nativespace-cdp sshd[165120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.24.31
Sep 10 11:32:02 nativespace-cdp sshd[165120]: Failed password for invalid user gitadmin from 209.38.24.31 port 57258 ssh2
Sep 10 11:32:03 nativespace-cdp sshd[165120]: Received disconnect from 209.38.24.31 port 57258:11: Bye Bye [preauth]
Sep 10 11:32:03 nativespace-cdp sshd[165120]: Disconnected from 209.38.24.31 port 57258 [preauth]
Sep 10 11:36:33 nativespace-cdp sshd[166439]: Connection closed by 159.100.136.21 port 38056 [preauth]
Sep 10 11:41:34 nativespace-cdp sshd[167887]: Connection closed by 159.100.136.21 port 47560 [preauth]
Sep 10 11:46:33 nativespace-cdp sshd[169644]: Connection closed by 159.100.136.21 port 56766 [preauth]
Sep 10 11:51:33 nativespace-cdp sshd[170964]: Connection closed by 159.100.136.21 port 37980 [preauth]
Sep 10 11:56:35 nativespace-cdp sshd[172367]: Connection closed by 159.100.136.21 port 47128 [preauth]
Sep 10 12:01:33 nativespace-cdp sshd[174110]: Connection closed by 159.100.136.21 port 56032 [preauth]
Sep 10 12:06:36 nativespace-cdp sshd[175271]: Connection closed by 159.100.136.21 port 37370 [preauth]
Sep 10 12:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 12:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:09:59 nativespace-cdp sudo[175903]: pam_unix(sudo:session): session closed for user root
Sep 10 12:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 12:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:09:59 nativespace-cdp sudo[175908]: pam_unix(sudo:session): session closed for user root
Sep 10 12:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 12:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:00 nativespace-cdp sudo[175911]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 12:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:00 nativespace-cdp sudo[175916]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 12:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:05 nativespace-cdp sudo[175919]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:06 nativespace-cdp sudo[176060]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:06 nativespace-cdp sudo[176063]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:06 nativespace-cdp sudo[176066]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:06 nativespace-cdp sudo[176069]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:06 nativespace-cdp sudo[176072]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 12:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:06 nativespace-cdp sudo[176075]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 12:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:13 nativespace-cdp sudo[176096]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 12:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:13 nativespace-cdp sudo[176100]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=cath user-2=sketchy user-3=havantho user-4=nvihkvu user-5=tstardom user-6=oubpgvbx user-7=what user-8=design user-9=ladburyp user-10=stagingerris user-11=dancinggardener user-12=kategilpin user-13=boldover user-14=nove user-15=bakery user-16=sosevalu user-17=crrtipdl user-18=onlycont user-19=attlebor user-20=lucy user-21=romaldki user-22=ranxterc user-23=hodgsonmail user-24=outdoorc user-25=branko user-26=jennimil user-27=tomandle user-28=careers user-29=nbhavers user-30=david user-31=chrisdal user-32=mcdermos user-33=howardon user-34=pugwash user-35=paulmca1 user-36=cwsocial user-37=cambria1 user-38=cathski user-39=reliable user-40=ninejimm user-41=eugincou user-42=courseme user-43=hirefootballgame user-44=lkpier user-45=ctedorgu user-46=philmcph user-47=steakbridieme user-48=donnychicago
Sep 10 12:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstre5 user-50=putterfc user-51=nscdp user-52=fortunaz user-53=health2045 user-54=leftie user-55=foods user-56=hidden user-57=nomistakes user-58=barbersh user-59=tigerlet user-60=isleofwi user-61=smrszyqg user-62=nsceres user-63=burydropin user-64=fawcettd user-65=dhyana user-66=beauty user-67=eatspam user-68=darkstar user-69=sibtoncc user-70=asandcoc user-71=steve user-72=bwppodcast user-73=zebrapho user-74=skyfirec user-75=alexadmin user-76=nativene user-77=innovat1 user-78=stuartge user-79=askhform user-80=firstre2 user-81=vivienn1 user-82=battlere user-83=oneoarco user-84=brighto1 user-85=nstriton user-86=belle user-87=ggaaorgu user-88=newstoda user-89=bemadonn user-90=bedfords user-91=hubmaster user-92=putterfi user-93=carsinyo user-94=fetch user-95=milloyco user-96=gilpin user-97=elecleis user-98=connectedshoppin user-99=thqkgnbz user-100=accooper user-101=ianrayne user-102=coursemc
Sep 10 12:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=opaiscyx user-104=jonhartl user-105=seftvta user-106=ultbcrra user-107=firstres user-108=firstred user-109=southlon user-110=highlegh user-111=clarkass user-112=firstrel user-113=costestimatorco user-114=dickemery123 user-115=ptkxhsbt user-116=martsblo user-117=magichat user-118=lbhyisi user-119=hhdugcor user-120=strathar user-121=sarafoundation user-122=atestord user-123=lakesan1 user-124=brmrjxl user-125=musorguk user-126=megacards user-127=wilsonsw user-128=spectrum user-129=theblack user-130=hodgesonweb user-131=jarvisin user-132=stephani user-133=leereyn1 user-134=still user-135=agproduc user-136=connect9 user-137=athenare user-138=vantagep user-139=maflemin user-140=lbscrmod user-141=booff user-142=markward user-143=foundation user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 12:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 12:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:14 nativespace-cdp sudo[176108]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 12:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:14 nativespace-cdp sudo[176118]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-IfEmIT73tcy0VSWD.~
Sep 10 12:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:14 nativespace-cdp sudo[176122]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-IfEmIT73tcy0VSWD.~'
Sep 10 12:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:14 nativespace-cdp sudo[176126]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-IfEmIT73tcy0VSWD.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 12:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:14 nativespace-cdp sudo[176130]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 12:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:14 nativespace-cdp sudo[176133]: pam_unix(sudo:session): session closed for user root
Sep 10 12:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 12:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 12:10:16 nativespace-cdp sudo[176153]: pam_unix(sudo:session): session closed for user root
Sep 10 12:11:33 nativespace-cdp sshd[176805]: Connection closed by 159.100.136.21 port 46794 [preauth]
Sep 10 12:16:34 nativespace-cdp sshd[178259]: Connection closed by 159.100.136.21 port 56434 [preauth]
Sep 10 12:21:33 nativespace-cdp sshd[179534]: Connection closed by 159.100.136.21 port 37270 [preauth]
Sep 10 12:26:33 nativespace-cdp sshd[180687]: Connection closed by 159.100.136.21 port 46534 [preauth]
Sep 10 12:31:33 nativespace-cdp sshd[182338]: Connection closed by 159.100.136.21 port 55920 [preauth]
Sep 10 12:33:32 nativespace-cdp sshd[159251]: Received disconnect from 185.67.178.249 port 55582:11: Normal Shutdown
Sep 10 12:33:32 nativespace-cdp sshd[159251]: Disconnected from 185.67.178.249 port 55582
Sep 10 12:33:32 nativespace-cdp sshd[159251]: pam_unix(sshd:session): session closed for user root
Sep 10 12:36:35 nativespace-cdp sshd[183453]: Connection closed by 159.100.136.21 port 37060 [preauth]
Sep 10 12:41:33 nativespace-cdp sshd[184868]: Connection closed by 159.100.136.21 port 45796 [preauth]
Sep 10 12:46:33 nativespace-cdp sshd[186179]: Connection closed by 159.100.136.21 port 55078 [preauth]
Sep 10 12:51:37 nativespace-cdp sshd[187441]: Connection closed by 159.100.136.21 port 36002 [preauth]
Sep 10 12:56:34 nativespace-cdp sshd[188730]: Connection closed by 159.100.136.21 port 45094 [preauth]
Sep 10 13:01:33 nativespace-cdp sshd[190295]: Connection closed by 159.100.136.21 port 54194 [preauth]
Sep 10 13:04:29 nativespace-cdp sshd[190832]: Bad protocol version identification '\026\003\001' from 206.168.34.40 port 49126
Sep 10 13:04:32 nativespace-cdp sshd[190882]: Did not receive identification string from 206.168.34.40 port 49132
Sep 10 13:04:54 nativespace-cdp sshd[190918]: Connection closed by 206.168.34.40 port 43462 [preauth]
Sep 10 13:06:35 nativespace-cdp sshd[191719]: Connection closed by 159.100.136.21 port 35836 [preauth]
Sep 10 13:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 13:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:10:32 nativespace-cdp sudo[192737]: pam_unix(sudo:session): session closed for user root
Sep 10 13:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 13:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:10:32 nativespace-cdp sudo[192742]: pam_unix(sudo:session): session closed for user root
Sep 10 13:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 13:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:10:34 nativespace-cdp sudo[192746]: pam_unix(sudo:session): session closed for user root
Sep 10 13:10:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 13:10:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:10:34 nativespace-cdp sudo[192754]: pam_unix(sudo:session): session closed for user root
Sep 10 13:10:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 13:10:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:11:11 nativespace-cdp sudo[192758]: pam_unix(sudo:session): session closed for user root
Sep 10 13:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 13:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:11:11 nativespace-cdp sudo[193010]: pam_unix(sudo:session): session closed for user root
Sep 10 13:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 13:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:11:11 nativespace-cdp sudo[193022]: pam_unix(sudo:session): session closed for user root
Sep 10 13:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 13:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:11:11 nativespace-cdp sudo[193026]: pam_unix(sudo:session): session closed for user root
Sep 10 13:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 13:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:11:11 nativespace-cdp sudo[193030]: pam_unix(sudo:session): session closed for user root
Sep 10 13:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 13:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:11:11 nativespace-cdp sudo[193034]: pam_unix(sudo:session): session closed for user root
Sep 10 13:11:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 13:11:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:11:12 nativespace-cdp sudo[193038]: pam_unix(sudo:session): session closed for user root
Sep 10 13:11:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 13:11:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:11:26 nativespace-cdp sudo[193166]: pam_unix(sudo:session): session closed for user root
Sep 10 13:11:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 13:11:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:11:36 nativespace-cdp sshd[193295]: Connection closed by 159.100.136.21 port 44664 [preauth]
Sep 10 13:11:39 nativespace-cdp sudo[193198]: pam_unix(sudo:session): session closed for user root
Sep 10 13:11:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=asandcoc user-2=sibtoncc user-3=bwppodcast user-4=zebrapho user-5=steve user-6=fawcettd user-7=burydropin user-8=nsceres user-9=beauty user-10=darkstar user-11=eatspam user-12=dhyana user-13=nscdp user-14=putterfc user-15=foods user-16=leftie user-17=fortunaz user-18=health2045 user-19=lkpier user-20=donnychicago user-21=steakbridieme user-22=firstre5 user-23=philmcph user-24=ctedorgu user-25=isleofwi user-26=smrszyqg user-27=nomistakes user-28=hidden user-29=barbersh user-30=tigerlet user-31=cathski user-32=cambria1 user-33=ninejimm user-34=reliable user-35=cwsocial user-36=paulmca1 user-37=pugwash user-38=howardon user-39=hirefootballgame user-40=eugincou user-41=courseme user-42=tomandle user-43=jennimil user-44=chrisdal user-45=mcdermos user-46=david user-47=nbhavers user-48=careers
Sep 10 13:11:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=lucy user-50=attlebor user-51=onlycont user-52=outdoorc user-53=hodgsonmail user-54=ranxterc user-55=branko user-56=romaldki user-57=nove user-58=boldover user-59=bakery user-60=crrtipdl user-61=sosevalu user-62=tstardom user-63=oubpgvbx user-64=what user-65=havantho user-66=sketchy user-67=cath user-68=nvihkvu user-69=dancinggardener user-70=stagingerris user-71=ladburyp user-72=kategilpin user-73=design user-74=booff user-75=markward user-76=foundation user-77=vantagep user-78=connect9 user-79=athenare user-80=lbscrmod user-81=maflemin user-82=ulsukarm user-83=jarvisin user-84=spectrum user-85=theblack user-86=hodgesonweb user-87=agproduc user-88=still user-89=stephani user-90=leereyn1 user-91=brmrjxl user-92=lakesan1 user-93=strathar user-94=atestord user-95=sarafoundation user-96=wilsonsw user-97=megacards user-98=musorguk user-99=martsblo user-100=dickemery123 user-101=ptkxhsbt user-102=hhdugcor
Sep 10 13:11:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=lbhyisi user-104=magichat user-105=ultbcrra user-106=jonhartl user-107=seftvta user-108=firstres user-109=coursemc user-110=opaiscyx user-111=clarkass user-112=firstrel user-113=costestimatorco user-114=firstred user-115=highlegh user-116=southlon user-117=milloyco user-118=gilpin user-119=elecleis user-120=putterfi user-121=hubmaster user-122=fetch user-123=carsinyo user-124=accooper user-125=ianrayne user-126=connectedshoppin user-127=thqkgnbz user-128=nstriton user-129=brighto1 user-130=vivienn1 user-131=firstre2 user-132=oneoarco user-133=battlere user-134=bedfords user-135=newstoda user-136=ggaaorgu user-137=belle user-138=bemadonn user-139=alexadmin user-140=skyfirec user-141=innovat1 user-142=stuartge user-143=askhform user-144=nativene feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 13:11:41 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 13:11:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:12:17 nativespace-cdp sudo[193352]: pam_unix(sudo:session): session closed for user root
Sep 10 13:12:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 13:12:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:12:22 nativespace-cdp sudo[193675]: pam_unix(sudo:session): session closed for user root
Sep 10 13:12:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-htlK441yXdtbd1i4.~
Sep 10 13:12:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:12:22 nativespace-cdp sudo[193685]: pam_unix(sudo:session): session closed for user root
Sep 10 13:12:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-htlK441yXdtbd1i4.~'
Sep 10 13:12:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:12:23 nativespace-cdp sudo[193690]: pam_unix(sudo:session): session closed for user root
Sep 10 13:12:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-htlK441yXdtbd1i4.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 13:12:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:12:23 nativespace-cdp sudo[193698]: pam_unix(sudo:session): session closed for user root
Sep 10 13:12:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 13:12:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:12:23 nativespace-cdp sudo[193702]: pam_unix(sudo:session): session closed for user root
Sep 10 13:12:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 13:12:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 13:12:59 nativespace-cdp sudo[193970]: pam_unix(sudo:session): session closed for user root
Sep 10 13:16:33 nativespace-cdp sshd[195589]: Connection closed by 159.100.136.21 port 53720 [preauth]
Sep 10 13:21:35 nativespace-cdp sshd[197553]: Connection closed by 159.100.136.21 port 34160 [preauth]
Sep 10 13:26:33 nativespace-cdp sshd[199916]: Connection closed by 159.100.136.21 port 43888 [preauth]
Sep 10 13:31:33 nativespace-cdp sshd[202625]: Connection closed by 159.100.136.21 port 52884 [preauth]
Sep 10 13:36:35 nativespace-cdp sshd[205122]: Connection closed by 159.100.136.21 port 33854 [preauth]
Sep 10 13:41:33 nativespace-cdp sshd[208537]: Connection closed by 159.100.136.21 port 43002 [preauth]
Sep 10 13:46:33 nativespace-cdp sshd[210030]: Connection closed by 159.100.136.21 port 52888 [preauth]
Sep 10 13:51:33 nativespace-cdp sshd[211211]: Connection closed by 159.100.136.21 port 33730 [preauth]
Sep 10 13:56:33 nativespace-cdp sshd[212482]: Connection closed by 159.100.136.21 port 43390 [preauth]
Sep 10 14:01:33 nativespace-cdp sshd[213869]: Connection closed by 159.100.136.21 port 52810 [preauth]
Sep 10 14:04:44 nativespace-cdp sshd[215000]: Invalid user arkserver from 193.95.30.6 port 47954
Sep 10 14:04:44 nativespace-cdp sshd[215000]: input_userauth_request: invalid user arkserver [preauth]
Sep 10 14:04:44 nativespace-cdp sshd[215000]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:04:44 nativespace-cdp sshd[215000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.95.30.6
Sep 10 14:04:47 nativespace-cdp sshd[215000]: Failed password for invalid user arkserver from 193.95.30.6 port 47954 ssh2
Sep 10 14:04:47 nativespace-cdp sshd[215000]: Received disconnect from 193.95.30.6 port 47954:11: Bye Bye [preauth]
Sep 10 14:04:47 nativespace-cdp sshd[215000]: Disconnected from 193.95.30.6 port 47954 [preauth]
Sep 10 14:04:59 nativespace-cdp sshd[215034]: Invalid user ali from 42.96.47.163 port 59188
Sep 10 14:04:59 nativespace-cdp sshd[215034]: input_userauth_request: invalid user ali [preauth]
Sep 10 14:04:59 nativespace-cdp sshd[215034]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:04:59 nativespace-cdp sshd[215034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.47.163
Sep 10 14:05:00 nativespace-cdp sshd[215034]: Failed password for invalid user ali from 42.96.47.163 port 59188 ssh2
Sep 10 14:05:00 nativespace-cdp sshd[215034]: Received disconnect from 42.96.47.163 port 59188:11: Bye Bye [preauth]
Sep 10 14:05:00 nativespace-cdp sshd[215034]: Disconnected from 42.96.47.163 port 59188 [preauth]
Sep 10 14:06:33 nativespace-cdp sshd[215700]: Connection closed by 159.100.136.21 port 33468 [preauth]
Sep 10 14:10:03 nativespace-cdp sshd[216512]: Invalid user git from 47.236.103.174 port 37202
Sep 10 14:10:03 nativespace-cdp sshd[216512]: input_userauth_request: invalid user git [preauth]
Sep 10 14:10:04 nativespace-cdp sshd[216512]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:10:04 nativespace-cdp sshd[216512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.103.174
Sep 10 14:10:06 nativespace-cdp sshd[216512]: Failed password for invalid user git from 47.236.103.174 port 37202 ssh2
Sep 10 14:10:06 nativespace-cdp sshd[216512]: Received disconnect from 47.236.103.174 port 37202:11: Bye Bye [preauth]
Sep 10 14:10:06 nativespace-cdp sshd[216512]: Disconnected from 47.236.103.174 port 37202 [preauth]
Sep 10 14:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 14:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:15 nativespace-cdp sudo[216711]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:15 nativespace-cdp sudo[216717]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:16 nativespace-cdp sudo[216722]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 14:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:16 nativespace-cdp sudo[216728]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 14:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:21 nativespace-cdp sudo[216735]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 14:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:21 nativespace-cdp sudo[216756]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 14:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:21 nativespace-cdp sudo[216761]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 14:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:21 nativespace-cdp sudo[216765]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 14:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:21 nativespace-cdp sudo[216770]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 14:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:22 nativespace-cdp sudo[216776]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 14:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:22 nativespace-cdp sudo[216781]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 14:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:24 nativespace-cdp sudo[216795]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 14:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:25 nativespace-cdp sudo[216802]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=markward user-3=booff user-4=foundation user-5=maflemin user-6=lbscrmod user-7=connect9 user-8=athenare user-9=vantagep user-10=still user-11=agproduc user-12=leereyn1 user-13=stephani user-14=jarvisin user-15=theblack user-16=hodgesonweb user-17=spectrum user-18=wilsonsw user-19=musorguk user-20=megacards user-21=lakesan1 user-22=brmrjxl user-23=sarafoundation user-24=atestord user-25=strathar user-26=lbhyisi user-27=hhdugcor user-28=magichat user-29=martsblo user-30=ptkxhsbt user-31=dickemery123 user-32=costestimatorco user-33=clarkass user-34=firstrel user-35=southlon user-36=highlegh user-37=firstred user-38=firstres user-39=jonhartl user-40=seftvta user-41=ultbcrra user-42=opaiscyx user-43=coursemc user-44=ianrayne user-45=accooper user-46=thqkgnbz user-47=connectedshoppin
Sep 10 14:10:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=elecleis user-49=milloyco user-50=gilpin user-51=carsinyo user-52=fetch user-53=putterfi user-54=hubmaster user-55=bedfords user-56=bemadonn user-57=ggaaorgu user-58=belle user-59=newstoda user-60=brighto1 user-61=nstriton user-62=battlere user-63=oneoarco user-64=firstre2 user-65=vivienn1 user-66=stuartge user-67=askhform user-68=innovat1 user-69=nativene user-70=alexadmin user-71=skyfirec user-72=zebrapho user-73=bwppodcast user-74=steve user-75=sibtoncc user-76=asandcoc user-77=eatspam user-78=darkstar user-79=beauty user-80=dhyana user-81=burydropin user-82=fawcettd user-83=nsceres user-84=smrszyqg user-85=isleofwi user-86=tigerlet user-87=barbersh user-88=hidden user-89=nomistakes user-90=fortunaz user-91=health2045 user-92=leftie user-93=foods user-94=putterfc user-95=nscdp user-96=ctedorgu user-97=philmcph user-98=firstre5 user-99=donnychicago user-100=steakbridieme user-101=lkpier
Sep 10 14:10:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hirefootballgame user-103=courseme user-104=eugincou user-105=ninejimm user-106=reliable user-107=cambria1 user-108=cathski user-109=paulmca1 user-110=pugwash user-111=howardon user-112=cwsocial user-113=mcdermos user-114=chrisdal user-115=careers user-116=nbhavers user-117=david user-118=tomandle user-119=jennimil user-120=branko user-121=hodgsonmail user-122=ranxterc user-123=outdoorc user-124=romaldki user-125=attlebor user-126=lucy user-127=onlycont user-128=sosevalu user-129=crrtipdl user-130=bakery user-131=nove user-132=boldover user-133=kategilpin user-134=ladburyp user-135=dancinggardener user-136=stagingerris user-137=design user-138=what user-139=tstardom user-140=oubpgvbx user-141=nvihkvu user-142=cath user-143=sketchy user-144=havantho feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 14:10:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 14:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:26 nativespace-cdp sudo[216813]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 14:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:26 nativespace-cdp sudo[216821]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VUq67ltoXhoDLDHu.~
Sep 10 14:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:27 nativespace-cdp sudo[216826]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VUq67ltoXhoDLDHu.~'
Sep 10 14:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:27 nativespace-cdp sudo[216830]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-VUq67ltoXhoDLDHu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 14:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:27 nativespace-cdp sudo[216836]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 14:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:27 nativespace-cdp sudo[216841]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 14:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 14:10:29 nativespace-cdp sudo[216875]: pam_unix(sudo:session): session closed for user root
Sep 10 14:10:52 nativespace-cdp sshd[216961]: Invalid user ali from 137.184.119.247 port 59508
Sep 10 14:10:52 nativespace-cdp sshd[216961]: input_userauth_request: invalid user ali [preauth]
Sep 10 14:10:52 nativespace-cdp sshd[216961]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:10:52 nativespace-cdp sshd[216961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.119.247
Sep 10 14:10:54 nativespace-cdp sshd[216961]: Failed password for invalid user ali from 137.184.119.247 port 59508 ssh2
Sep 10 14:10:57 nativespace-cdp sshd[216961]: Received disconnect from 137.184.119.247 port 59508:11: Bye Bye [preauth]
Sep 10 14:10:57 nativespace-cdp sshd[216961]: Disconnected from 137.184.119.247 port 59508 [preauth]
Sep 10 14:11:33 nativespace-cdp sshd[217619]: Connection closed by 159.100.136.21 port 42904 [preauth]
Sep 10 14:12:10 nativespace-cdp sshd[217743]: Invalid user heera from 193.95.30.6 port 52230
Sep 10 14:12:10 nativespace-cdp sshd[217743]: input_userauth_request: invalid user heera [preauth]
Sep 10 14:12:10 nativespace-cdp sshd[217743]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:12:10 nativespace-cdp sshd[217743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.95.30.6
Sep 10 14:12:11 nativespace-cdp sshd[217743]: Failed password for invalid user heera from 193.95.30.6 port 52230 ssh2
Sep 10 14:12:13 nativespace-cdp sshd[217743]: Received disconnect from 193.95.30.6 port 52230:11: Bye Bye [preauth]
Sep 10 14:12:13 nativespace-cdp sshd[217743]: Disconnected from 193.95.30.6 port 52230 [preauth]
Sep 10 14:12:46 nativespace-cdp sshd[217833]: Invalid user tgn from 137.184.119.247 port 51982
Sep 10 14:12:46 nativespace-cdp sshd[217833]: input_userauth_request: invalid user tgn [preauth]
Sep 10 14:12:46 nativespace-cdp sshd[217833]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:12:46 nativespace-cdp sshd[217833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.119.247
Sep 10 14:12:47 nativespace-cdp sshd[217833]: Failed password for invalid user tgn from 137.184.119.247 port 51982 ssh2
Sep 10 14:12:47 nativespace-cdp sshd[217833]: Received disconnect from 137.184.119.247 port 51982:11: Bye Bye [preauth]
Sep 10 14:12:47 nativespace-cdp sshd[217833]: Disconnected from 137.184.119.247 port 51982 [preauth]
Sep 10 14:12:52 nativespace-cdp sshd[217884]: Invalid user jimmy from 193.95.30.6 port 50310
Sep 10 14:12:52 nativespace-cdp sshd[217884]: input_userauth_request: invalid user jimmy [preauth]
Sep 10 14:12:52 nativespace-cdp sshd[217884]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:12:52 nativespace-cdp sshd[217884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.95.30.6
Sep 10 14:12:52 nativespace-cdp sshd[217882]: Invalid user hadoop from 42.96.47.163 port 39386
Sep 10 14:12:52 nativespace-cdp sshd[217882]: input_userauth_request: invalid user hadoop [preauth]
Sep 10 14:12:52 nativespace-cdp sshd[217882]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:12:52 nativespace-cdp sshd[217882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.47.163
Sep 10 14:12:53 nativespace-cdp sshd[217884]: Failed password for invalid user jimmy from 193.95.30.6 port 50310 ssh2
Sep 10 14:12:53 nativespace-cdp sshd[217884]: Received disconnect from 193.95.30.6 port 50310:11: Bye Bye [preauth]
Sep 10 14:12:53 nativespace-cdp sshd[217884]: Disconnected from 193.95.30.6 port 50310 [preauth]
Sep 10 14:12:54 nativespace-cdp sshd[217882]: Failed password for invalid user hadoop from 42.96.47.163 port 39386 ssh2
Sep 10 14:12:54 nativespace-cdp sshd[217882]: Received disconnect from 42.96.47.163 port 39386:11: Bye Bye [preauth]
Sep 10 14:12:54 nativespace-cdp sshd[217882]: Disconnected from 42.96.47.163 port 39386 [preauth]
Sep 10 14:13:16 nativespace-cdp sshd[218004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.119.247  user=root
Sep 10 14:13:16 nativespace-cdp sshd[218004]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 14:13:18 nativespace-cdp sshd[218004]: Failed password for root from 137.184.119.247 port 38772 ssh2
Sep 10 14:13:18 nativespace-cdp sshd[218004]: Received disconnect from 137.184.119.247 port 38772:11: Bye Bye [preauth]
Sep 10 14:13:18 nativespace-cdp sshd[218004]: Disconnected from 137.184.119.247 port 38772 [preauth]
Sep 10 14:13:28 nativespace-cdp sshd[218054]: Invalid user monitoreo from 47.236.103.174 port 57318
Sep 10 14:13:28 nativespace-cdp sshd[218054]: input_userauth_request: invalid user monitoreo [preauth]
Sep 10 14:13:28 nativespace-cdp sshd[218054]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:13:28 nativespace-cdp sshd[218054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.103.174
Sep 10 14:13:30 nativespace-cdp sshd[218054]: Failed password for invalid user monitoreo from 47.236.103.174 port 57318 ssh2
Sep 10 14:13:31 nativespace-cdp sshd[218054]: Received disconnect from 47.236.103.174 port 57318:11: Bye Bye [preauth]
Sep 10 14:13:31 nativespace-cdp sshd[218054]: Disconnected from 47.236.103.174 port 57318 [preauth]
Sep 10 14:13:55 nativespace-cdp sshd[218135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.47.163  user=root
Sep 10 14:13:55 nativespace-cdp sshd[218135]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 14:13:57 nativespace-cdp sshd[218135]: Failed password for root from 42.96.47.163 port 60112 ssh2
Sep 10 14:14:05 nativespace-cdp sshd[218207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.103.174  user=root
Sep 10 14:14:05 nativespace-cdp sshd[218207]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 14:14:06 nativespace-cdp sshd[218207]: Failed password for root from 47.236.103.174 port 34368 ssh2
Sep 10 14:16:34 nativespace-cdp sshd[219115]: Connection closed by 159.100.136.21 port 52202 [preauth]
Sep 10 14:21:36 nativespace-cdp sshd[220402]: Connection closed by 159.100.136.21 port 33106 [preauth]
Sep 10 14:31:33 nativespace-cdp sshd[225208]: Connection closed by 159.100.136.21 port 52616 [preauth]
Sep 10 14:36:33 nativespace-cdp sshd[226866]: Connection closed by 159.100.136.21 port 33142 [preauth]
Sep 10 14:41:34 nativespace-cdp sshd[228120]: Connection closed by 159.100.136.21 port 42710 [preauth]
Sep 10 14:41:37 nativespace-cdp sshd[228132]: Invalid user tim from 81.17.99.122 port 37476
Sep 10 14:41:37 nativespace-cdp sshd[228132]: input_userauth_request: invalid user tim [preauth]
Sep 10 14:41:37 nativespace-cdp sshd[228132]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:41:37 nativespace-cdp sshd[228132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.17.99.122
Sep 10 14:41:39 nativespace-cdp sshd[228132]: Failed password for invalid user tim from 81.17.99.122 port 37476 ssh2
Sep 10 14:41:41 nativespace-cdp sshd[228132]: Received disconnect from 81.17.99.122 port 37476:11: Bye Bye [preauth]
Sep 10 14:41:41 nativespace-cdp sshd[228132]: Disconnected from 81.17.99.122 port 37476 [preauth]
Sep 10 14:43:26 nativespace-cdp sshd[228553]: Invalid user huw from 167.71.196.217 port 43316
Sep 10 14:43:26 nativespace-cdp sshd[228553]: input_userauth_request: invalid user huw [preauth]
Sep 10 14:43:26 nativespace-cdp sshd[228553]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:43:26 nativespace-cdp sshd[228553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.196.217
Sep 10 14:43:28 nativespace-cdp sshd[228553]: Failed password for invalid user huw from 167.71.196.217 port 43316 ssh2
Sep 10 14:43:28 nativespace-cdp sshd[228553]: Received disconnect from 167.71.196.217 port 43316:11: Bye Bye [preauth]
Sep 10 14:43:28 nativespace-cdp sshd[228553]: Disconnected from 167.71.196.217 port 43316 [preauth]
Sep 10 14:46:33 nativespace-cdp sshd[229819]: Connection closed by 159.100.136.21 port 52178 [preauth]
Sep 10 14:47:44 nativespace-cdp sshd[230043]: Invalid user tim from 107.0.200.227 port 38416
Sep 10 14:47:44 nativespace-cdp sshd[230043]: input_userauth_request: invalid user tim [preauth]
Sep 10 14:47:44 nativespace-cdp sshd[230043]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:47:44 nativespace-cdp sshd[230043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.0.200.227
Sep 10 14:47:47 nativespace-cdp sshd[230043]: Failed password for invalid user tim from 107.0.200.227 port 38416 ssh2
Sep 10 14:47:47 nativespace-cdp sshd[230043]: Received disconnect from 107.0.200.227 port 38416:11: Bye Bye [preauth]
Sep 10 14:47:47 nativespace-cdp sshd[230043]: Disconnected from 107.0.200.227 port 38416 [preauth]
Sep 10 14:48:06 nativespace-cdp sshd[230149]: Invalid user route from 81.17.99.122 port 37662
Sep 10 14:48:06 nativespace-cdp sshd[230149]: input_userauth_request: invalid user route [preauth]
Sep 10 14:48:06 nativespace-cdp sshd[230149]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:48:06 nativespace-cdp sshd[230149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.17.99.122
Sep 10 14:48:08 nativespace-cdp sshd[230149]: Failed password for invalid user route from 81.17.99.122 port 37662 ssh2
Sep 10 14:48:08 nativespace-cdp sshd[230149]: Received disconnect from 81.17.99.122 port 37662:11: Bye Bye [preauth]
Sep 10 14:48:08 nativespace-cdp sshd[230149]: Disconnected from 81.17.99.122 port 37662 [preauth]
Sep 10 14:48:26 nativespace-cdp sshd[230225]: Invalid user ups from 107.0.200.227 port 51536
Sep 10 14:48:26 nativespace-cdp sshd[230225]: input_userauth_request: invalid user ups [preauth]
Sep 10 14:48:26 nativespace-cdp sshd[230225]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:48:26 nativespace-cdp sshd[230225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.0.200.227
Sep 10 14:48:29 nativespace-cdp sshd[230225]: Failed password for invalid user ups from 107.0.200.227 port 51536 ssh2
Sep 10 14:48:29 nativespace-cdp sshd[230225]: Received disconnect from 107.0.200.227 port 51536:11: Bye Bye [preauth]
Sep 10 14:48:29 nativespace-cdp sshd[230225]: Disconnected from 107.0.200.227 port 51536 [preauth]
Sep 10 14:49:04 nativespace-cdp sshd[230336]: Invalid user pak from 81.17.99.122 port 37726
Sep 10 14:49:04 nativespace-cdp sshd[230336]: input_userauth_request: invalid user pak [preauth]
Sep 10 14:49:04 nativespace-cdp sshd[230336]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:49:04 nativespace-cdp sshd[230336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.17.99.122
Sep 10 14:49:05 nativespace-cdp sshd[230336]: Failed password for invalid user pak from 81.17.99.122 port 37726 ssh2
Sep 10 14:49:05 nativespace-cdp sshd[230336]: Received disconnect from 81.17.99.122 port 37726:11: Bye Bye [preauth]
Sep 10 14:49:05 nativespace-cdp sshd[230336]: Disconnected from 81.17.99.122 port 37726 [preauth]
Sep 10 14:49:06 nativespace-cdp sshd[230354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.196.217  user=root
Sep 10 14:49:06 nativespace-cdp sshd[230354]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 14:49:09 nativespace-cdp sshd[230354]: Failed password for root from 167.71.196.217 port 56068 ssh2
Sep 10 14:49:11 nativespace-cdp sshd[230354]: Received disconnect from 167.71.196.217 port 56068:11: Bye Bye [preauth]
Sep 10 14:49:11 nativespace-cdp sshd[230354]: Disconnected from 167.71.196.217 port 56068 [preauth]
Sep 10 14:49:12 nativespace-cdp sshd[230390]: Invalid user ljq from 107.0.200.227 port 36482
Sep 10 14:49:12 nativespace-cdp sshd[230390]: input_userauth_request: invalid user ljq [preauth]
Sep 10 14:49:12 nativespace-cdp sshd[230390]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:49:12 nativespace-cdp sshd[230390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.0.200.227
Sep 10 14:49:14 nativespace-cdp sshd[230390]: Failed password for invalid user ljq from 107.0.200.227 port 36482 ssh2
Sep 10 14:49:14 nativespace-cdp sshd[230390]: Received disconnect from 107.0.200.227 port 36482:11: Bye Bye [preauth]
Sep 10 14:49:14 nativespace-cdp sshd[230390]: Disconnected from 107.0.200.227 port 36482 [preauth]
Sep 10 14:50:02 nativespace-cdp sshd[230526]: Invalid user tor from 167.71.196.217 port 54296
Sep 10 14:50:02 nativespace-cdp sshd[230526]: input_userauth_request: invalid user tor [preauth]
Sep 10 14:50:02 nativespace-cdp sshd[230526]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:50:02 nativespace-cdp sshd[230526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.196.217
Sep 10 14:50:04 nativespace-cdp sshd[230526]: Failed password for invalid user tor from 167.71.196.217 port 54296 ssh2
Sep 10 14:50:04 nativespace-cdp sshd[230526]: Received disconnect from 167.71.196.217 port 54296:11: Bye Bye [preauth]
Sep 10 14:50:04 nativespace-cdp sshd[230526]: Disconnected from 167.71.196.217 port 54296 [preauth]
Sep 10 14:51:33 nativespace-cdp sshd[231153]: Connection closed by 159.100.136.21 port 60776 [preauth]
Sep 10 14:55:01 nativespace-cdp sshd[231944]: Invalid user huw from 189.82.210.167 port 54207
Sep 10 14:55:01 nativespace-cdp sshd[231944]: input_userauth_request: invalid user huw [preauth]
Sep 10 14:55:01 nativespace-cdp sshd[231944]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 14:55:01 nativespace-cdp sshd[231944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.82.210.167
Sep 10 14:55:03 nativespace-cdp sshd[231944]: Failed password for invalid user huw from 189.82.210.167 port 54207 ssh2
Sep 10 14:55:04 nativespace-cdp sshd[231944]: Received disconnect from 189.82.210.167 port 54207:11: Bye Bye [preauth]
Sep 10 14:55:04 nativespace-cdp sshd[231944]: Disconnected from 189.82.210.167 port 54207 [preauth]
Sep 10 14:56:33 nativespace-cdp sshd[232744]: Connection closed by 159.100.136.21 port 41806 [preauth]
Sep 10 14:59:10 nativespace-cdp sshd[233336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.82.210.167  user=root
Sep 10 14:59:10 nativespace-cdp sshd[233336]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 14:59:12 nativespace-cdp sshd[233336]: Failed password for root from 189.82.210.167 port 38011 ssh2
Sep 10 14:59:12 nativespace-cdp sshd[233336]: Received disconnect from 189.82.210.167 port 38011:11: Bye Bye [preauth]
Sep 10 14:59:12 nativespace-cdp sshd[233336]: Disconnected from 189.82.210.167 port 38011 [preauth]
Sep 10 15:00:54 nativespace-cdp sshd[233823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.82.210.167  user=root
Sep 10 15:00:54 nativespace-cdp sshd[233823]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 15:00:56 nativespace-cdp sshd[233823]: Failed password for root from 189.82.210.167 port 58557 ssh2
Sep 10 15:01:33 nativespace-cdp sshd[234019]: Connection closed by 159.100.136.21 port 51318 [preauth]
Sep 10 15:06:33 nativespace-cdp sshd[235243]: Connection closed by 159.100.136.21 port 58032 [preauth]
Sep 10 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:09 nativespace-cdp sudo[236226]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:09 nativespace-cdp sudo[236229]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 15:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:11 nativespace-cdp sudo[236232]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 15:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:11 nativespace-cdp sudo[236242]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 15:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:15 nativespace-cdp sudo[236245]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:15 nativespace-cdp sudo[236259]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:15 nativespace-cdp sudo[236262]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:15 nativespace-cdp sudo[236265]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:15 nativespace-cdp sudo[236268]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:15 nativespace-cdp sudo[236271]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 15:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:15 nativespace-cdp sudo[236274]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 15:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:23 nativespace-cdp sudo[236306]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 15:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:24 nativespace-cdp sudo[236311]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=leereyn1 user-2=stephani user-3=still user-4=agproduc user-5=theblack user-6=hodgesonweb user-7=spectrum user-8=jarvisin user-9=ulsukarm user-10=maflemin user-11=lbscrmod user-12=athenare user-13=connect9 user-14=vantagep user-15=booff user-16=markward user-17=foundation user-18=magichat user-19=lbhyisi user-20=hhdugcor user-21=ptkxhsbt user-22=dickemery123 user-23=martsblo user-24=musorguk user-25=megacards user-26=wilsonsw user-27=sarafoundation user-28=atestord user-29=strathar user-30=brmrjxl user-31=lakesan1 user-32=thqkgnbz user-33=connectedshoppin user-34=ianrayne user-35=accooper user-36=carsinyo user-37=fetch user-38=putterfi user-39=hubmaster user-40=elecleis user-41=milloyco user-42=gilpin user-43=southlon user-44=highlegh user-45=firstred user-46=costestimatorco user-47=clarkass
Sep 10 15:10:24 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=firstrel user-49=opaiscyx user-50=coursemc user-51=firstres user-52=seftvta user-53=jonhartl user-54=ultbcrra user-55=nativene user-56=askhform user-57=stuartge user-58=innovat1 user-59=alexadmin user-60=skyfirec user-61=bemadonn user-62=belle user-63=ggaaorgu user-64=newstoda user-65=bedfords user-66=battlere user-67=oneoarco user-68=firstre2 user-69=vivienn1 user-70=brighto1 user-71=nstriton user-72=dhyana user-73=eatspam user-74=darkstar user-75=beauty user-76=nsceres user-77=burydropin user-78=fawcettd user-79=steve user-80=zebrapho user-81=bwppodcast user-82=asandcoc user-83=sibtoncc user-84=courseme user-85=eugincou user-86=hirefootballgame user-87=pugwash user-88=paulmca1 user-89=howardon user-90=cwsocial user-91=ninejimm user-92=reliable user-93=cambria1 user-94=cathski user-95=barbersh user-96=tigerlet user-97=hidden user-98=nomistakes user-99=isleofwi user-100=smrszyqg user-101=ctedorgu
Sep 10 15:10:24 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=philmcph user-103=firstre5 user-104=donnychicago user-105=steakbridieme user-106=lkpier user-107=health2045 user-108=fortunaz user-109=leftie user-110=foods user-111=putterfc user-112=nscdp user-113=romaldki user-114=branko user-115=ranxterc user-116=outdoorc user-117=hodgsonmail user-118=onlycont user-119=attlebor user-120=lucy user-121=careers user-122=nbhavers user-123=david user-124=mcdermos user-125=chrisdal user-126=jennimil user-127=tomandle user-128=design user-129=kategilpin user-130=ladburyp user-131=dancinggardener user-132=stagingerris user-133=nvihkvu user-134=sketchy user-135=cath user-136=havantho user-137=what user-138=tstardom user-139=oubpgvbx user-140=sosevalu user-141=crrtipdl user-142=bakery user-143=boldover user-144=nove feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 15:10:24 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 15:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:25 nativespace-cdp sudo[236318]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 15:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:26 nativespace-cdp sudo[236323]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2DF0Y3sQWC0NtHvu.~
Sep 10 15:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:26 nativespace-cdp sudo[236326]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2DF0Y3sQWC0NtHvu.~'
Sep 10 15:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:26 nativespace-cdp sudo[236330]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2DF0Y3sQWC0NtHvu.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 15:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:26 nativespace-cdp sudo[236335]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 15:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:26 nativespace-cdp sudo[236338]: pam_unix(sudo:session): session closed for user root
Sep 10 15:10:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 15:10:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 15:10:43 nativespace-cdp sudo[236469]: pam_unix(sudo:session): session closed for user root
Sep 10 15:11:34 nativespace-cdp sshd[236933]: Connection closed by 159.100.136.21 port 38018 [preauth]
Sep 10 15:16:35 nativespace-cdp sshd[238381]: Connection closed by 159.100.136.21 port 48026 [preauth]
Sep 10 15:21:33 nativespace-cdp sshd[239567]: Connection closed by 159.100.136.21 port 57378 [preauth]
Sep 10 15:26:34 nativespace-cdp sshd[240832]: Connection closed by 159.100.136.21 port 38716 [preauth]
Sep 10 15:31:33 nativespace-cdp sshd[242465]: Connection closed by 159.100.136.21 port 47428 [preauth]
Sep 10 15:41:33 nativespace-cdp sshd[245296]: Connection closed by 159.100.136.21 port 36170 [preauth]
Sep 10 15:46:33 nativespace-cdp sshd[246686]: Connection closed by 159.100.136.21 port 45496 [preauth]
Sep 10 15:51:33 nativespace-cdp sshd[247897]: Connection closed by 159.100.136.21 port 54826 [preauth]
Sep 10 15:56:33 nativespace-cdp sshd[249264]: Connection closed by 159.100.136.21 port 36500 [preauth]
Sep 10 16:01:33 nativespace-cdp sshd[250884]: Connection closed by 159.100.136.21 port 45560 [preauth]
Sep 10 16:06:33 nativespace-cdp sshd[252310]: Connection closed by 159.100.136.21 port 55344 [preauth]
Sep 10 16:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 16:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:11 nativespace-cdp sudo[253327]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 16:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:11 nativespace-cdp sudo[253331]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 16:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:14 nativespace-cdp sudo[253337]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 16:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:14 nativespace-cdp sudo[253357]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 16:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:17 nativespace-cdp sudo[253363]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 16:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:17 nativespace-cdp sudo[253376]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 16:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:17 nativespace-cdp sudo[253381]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 16:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:17 nativespace-cdp sudo[253385]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 16:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:17 nativespace-cdp sudo[253390]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 16:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:17 nativespace-cdp sudo[253395]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 16:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:17 nativespace-cdp sudo[253401]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 16:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:22 nativespace-cdp sudo[253417]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 16:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:23 nativespace-cdp sudo[253424]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nsceres user-2=fawcettd user-3=burydropin user-4=dhyana user-5=beauty user-6=darkstar user-7=eatspam user-8=asandcoc user-9=sibtoncc user-10=steve user-11=bwppodcast user-12=zebrapho user-13=cwsocial user-14=pugwash user-15=howardon user-16=paulmca1 user-17=cambria1 user-18=cathski user-19=ninejimm user-20=reliable user-21=eugincou user-22=courseme user-23=hirefootballgame user-24=lkpier user-25=steakbridieme user-26=donnychicago user-27=firstre5 user-28=ctedorgu user-29=philmcph user-30=nscdp user-31=putterfc user-32=foods user-33=leftie user-34=fortunaz user-35=health2045 user-36=nomistakes user-37=hidden user-38=tigerlet user-39=barbersh user-40=isleofwi user-41=smrszyqg user-42=onlycont user-43=lucy user-44=attlebor user-45=romaldki user-46=outdoorc user-47=hodgsonmail user-48=ranxterc
Sep 10 16:10:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=branko user-50=jennimil user-51=tomandle user-52=david user-53=nbhavers user-54=careers user-55=chrisdal user-56=mcdermos user-57=havantho user-58=sketchy user-59=cath user-60=nvihkvu user-61=oubpgvbx user-62=tstardom user-63=what user-64=design user-65=stagingerris user-66=dancinggardener user-67=ladburyp user-68=kategilpin user-69=boldover user-70=nove user-71=bakery user-72=crrtipdl user-73=sosevalu user-74=spectrum user-75=hodgesonweb user-76=theblack user-77=jarvisin user-78=stephani user-79=leereyn1 user-80=agproduc user-81=still user-82=vantagep user-83=athenare user-84=connect9 user-85=lbscrmod user-86=maflemin user-87=booff user-88=foundation user-89=markward user-90=ulsukarm user-91=dickemery123 user-92=ptkxhsbt user-93=martsblo user-94=magichat user-95=hhdugcor user-96=lbhyisi user-97=strathar user-98=atestord user-99=sarafoundation user-100=lakesan1 user-101=brmrjxl user-102=megacards
Sep 10 16:10:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=musorguk user-104=wilsonsw user-105=hubmaster user-106=putterfi user-107=fetch user-108=carsinyo user-109=milloyco user-110=gilpin user-111=elecleis user-112=connectedshoppin user-113=thqkgnbz user-114=accooper user-115=ianrayne user-116=opaiscyx user-117=coursemc user-118=ultbcrra user-119=seftvta user-120=jonhartl user-121=firstres user-122=firstred user-123=highlegh user-124=southlon user-125=clarkass user-126=firstrel user-127=costestimatorco user-128=skyfirec user-129=alexadmin user-130=nativene user-131=innovat1 user-132=stuartge user-133=askhform user-134=vivienn1 user-135=firstre2 user-136=oneoarco user-137=battlere user-138=nstriton user-139=brighto1 user-140=newstoda user-141=ggaaorgu user-142=belle user-143=bemadonn user-144=bedfords feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 16:10:23 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 16:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:24 nativespace-cdp sudo[253431]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 16:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:24 nativespace-cdp sudo[253438]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EVtVMeFXM8sseV4t.~
Sep 10 16:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:24 nativespace-cdp sudo[253443]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EVtVMeFXM8sseV4t.~'
Sep 10 16:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:24 nativespace-cdp sudo[253447]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EVtVMeFXM8sseV4t.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 16:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:24 nativespace-cdp sudo[253453]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 16:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:25 nativespace-cdp sudo[253459]: pam_unix(sudo:session): session closed for user root
Sep 10 16:10:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 16:10:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 16:10:51 nativespace-cdp sudo[253568]: pam_unix(sudo:session): session closed for user root
Sep 10 16:11:34 nativespace-cdp sshd[253810]: Connection closed by 159.100.136.21 port 36368 [preauth]
Sep 10 16:21:33 nativespace-cdp sshd[256532]: Connection closed by 159.100.136.21 port 54972 [preauth]
Sep 10 16:22:06 nativespace-cdp sshd[256718]: Invalid user jicofo from 162.214.170.169 port 58732
Sep 10 16:22:06 nativespace-cdp sshd[256718]: input_userauth_request: invalid user jicofo [preauth]
Sep 10 16:22:06 nativespace-cdp sshd[256718]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:22:06 nativespace-cdp sshd[256718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.170.169
Sep 10 16:22:08 nativespace-cdp sshd[256718]: Failed password for invalid user jicofo from 162.214.170.169 port 58732 ssh2
Sep 10 16:22:08 nativespace-cdp sshd[256718]: Received disconnect from 162.214.170.169 port 58732:11: Bye Bye [preauth]
Sep 10 16:22:08 nativespace-cdp sshd[256718]: Disconnected from 162.214.170.169 port 58732 [preauth]
Sep 10 16:22:56 nativespace-cdp sshd[256909]: Invalid user lisa from 47.238.234.93 port 56474
Sep 10 16:22:56 nativespace-cdp sshd[256909]: input_userauth_request: invalid user lisa [preauth]
Sep 10 16:22:56 nativespace-cdp sshd[256909]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:22:56 nativespace-cdp sshd[256909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.238.234.93
Sep 10 16:22:58 nativespace-cdp sshd[256909]: Failed password for invalid user lisa from 47.238.234.93 port 56474 ssh2
Sep 10 16:22:58 nativespace-cdp sshd[256909]: Received disconnect from 47.238.234.93 port 56474:11: Bye Bye [preauth]
Sep 10 16:22:58 nativespace-cdp sshd[256909]: Disconnected from 47.238.234.93 port 56474 [preauth]
Sep 10 16:23:13 nativespace-cdp sshd[257122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.102.53  user=root
Sep 10 16:23:13 nativespace-cdp sshd[257122]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 16:23:15 nativespace-cdp sshd[257122]: Failed password for root from 146.190.102.53 port 49646 ssh2
Sep 10 16:23:15 nativespace-cdp sshd[257122]: Received disconnect from 146.190.102.53 port 49646:11: Bye Bye [preauth]
Sep 10 16:23:15 nativespace-cdp sshd[257122]: Disconnected from 146.190.102.53 port 49646 [preauth]
Sep 10 16:23:40 nativespace-cdp sshd[257244]: Invalid user parvin from 159.89.163.69 port 56982
Sep 10 16:23:40 nativespace-cdp sshd[257244]: input_userauth_request: invalid user parvin [preauth]
Sep 10 16:23:40 nativespace-cdp sshd[257244]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:23:40 nativespace-cdp sshd[257244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.163.69
Sep 10 16:23:43 nativespace-cdp sshd[257244]: Failed password for invalid user parvin from 159.89.163.69 port 56982 ssh2
Sep 10 16:23:43 nativespace-cdp sshd[257244]: Received disconnect from 159.89.163.69 port 56982:11: Bye Bye [preauth]
Sep 10 16:23:43 nativespace-cdp sshd[257244]: Disconnected from 159.89.163.69 port 56982 [preauth]
Sep 10 16:26:33 nativespace-cdp sshd[258148]: Connection closed by 159.100.136.21 port 36158 [preauth]
Sep 10 16:29:05 nativespace-cdp sshd[258967]: Invalid user weblogic from 190.111.249.136 port 55132
Sep 10 16:29:05 nativespace-cdp sshd[258967]: input_userauth_request: invalid user weblogic [preauth]
Sep 10 16:29:05 nativespace-cdp sshd[258967]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:29:05 nativespace-cdp sshd[258967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.111.249.136
Sep 10 16:29:08 nativespace-cdp sshd[258967]: Failed password for invalid user weblogic from 190.111.249.136 port 55132 ssh2
Sep 10 16:29:08 nativespace-cdp sshd[258967]: Received disconnect from 190.111.249.136 port 55132:11: Bye Bye [preauth]
Sep 10 16:29:08 nativespace-cdp sshd[258967]: Disconnected from 190.111.249.136 port 55132 [preauth]
Sep 10 16:29:18 nativespace-cdp sshd[259042]: Invalid user jicofo from 159.89.163.69 port 46900
Sep 10 16:29:18 nativespace-cdp sshd[259042]: input_userauth_request: invalid user jicofo [preauth]
Sep 10 16:29:18 nativespace-cdp sshd[259042]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:29:18 nativespace-cdp sshd[259042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.163.69
Sep 10 16:29:20 nativespace-cdp sshd[259042]: Failed password for invalid user jicofo from 159.89.163.69 port 46900 ssh2
Sep 10 16:29:23 nativespace-cdp sshd[259042]: Received disconnect from 159.89.163.69 port 46900:11: Bye Bye [preauth]
Sep 10 16:29:23 nativespace-cdp sshd[259042]: Disconnected from 159.89.163.69 port 46900 [preauth]
Sep 10 16:29:48 nativespace-cdp sshd[259191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.170.169  user=root
Sep 10 16:29:48 nativespace-cdp sshd[259191]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 16:29:50 nativespace-cdp sshd[259191]: Failed password for root from 162.214.170.169 port 58402 ssh2
Sep 10 16:29:50 nativespace-cdp sshd[259191]: Received disconnect from 162.214.170.169 port 58402:11: Bye Bye [preauth]
Sep 10 16:29:50 nativespace-cdp sshd[259191]: Disconnected from 162.214.170.169 port 58402 [preauth]
Sep 10 16:30:12 nativespace-cdp sshd[259433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.163.69  user=root
Sep 10 16:30:12 nativespace-cdp sshd[259433]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 16:30:14 nativespace-cdp sshd[259433]: Failed password for root from 159.89.163.69 port 38172 ssh2
Sep 10 16:30:14 nativespace-cdp sshd[259433]: Received disconnect from 159.89.163.69 port 38172:11: Bye Bye [preauth]
Sep 10 16:30:14 nativespace-cdp sshd[259433]: Disconnected from 159.89.163.69 port 38172 [preauth]
Sep 10 16:30:21 nativespace-cdp sshd[259514]: Invalid user tsingsoon from 146.190.102.53 port 45752
Sep 10 16:30:21 nativespace-cdp sshd[259514]: input_userauth_request: invalid user tsingsoon [preauth]
Sep 10 16:30:21 nativespace-cdp sshd[259514]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:30:21 nativespace-cdp sshd[259514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.102.53
Sep 10 16:30:23 nativespace-cdp sshd[259514]: Failed password for invalid user tsingsoon from 146.190.102.53 port 45752 ssh2
Sep 10 16:30:24 nativespace-cdp sshd[259514]: Received disconnect from 146.190.102.53 port 45752:11: Bye Bye [preauth]
Sep 10 16:30:24 nativespace-cdp sshd[259514]: Disconnected from 146.190.102.53 port 45752 [preauth]
Sep 10 16:30:35 nativespace-cdp sshd[259580]: Invalid user deepthi from 162.214.170.169 port 43224
Sep 10 16:30:35 nativespace-cdp sshd[259580]: input_userauth_request: invalid user deepthi [preauth]
Sep 10 16:30:35 nativespace-cdp sshd[259580]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:30:35 nativespace-cdp sshd[259580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.170.169
Sep 10 16:30:38 nativespace-cdp sshd[259580]: Failed password for invalid user deepthi from 162.214.170.169 port 43224 ssh2
Sep 10 16:30:45 nativespace-cdp sshd[259633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.238.234.93  user=root
Sep 10 16:30:45 nativespace-cdp sshd[259633]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 16:30:47 nativespace-cdp sshd[259633]: Failed password for root from 47.238.234.93 port 55766 ssh2
Sep 10 16:30:53 nativespace-cdp sshd[259633]: Received disconnect from 47.238.234.93 port 55766:11: Bye Bye [preauth]
Sep 10 16:30:53 nativespace-cdp sshd[259633]: Disconnected from 47.238.234.93 port 55766 [preauth]
Sep 10 16:31:06 nativespace-cdp sshd[259703]: Invalid user jicofo from 146.190.102.53 port 45108
Sep 10 16:31:06 nativespace-cdp sshd[259703]: input_userauth_request: invalid user jicofo [preauth]
Sep 10 16:31:06 nativespace-cdp sshd[259703]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:31:06 nativespace-cdp sshd[259703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.102.53
Sep 10 16:31:08 nativespace-cdp sshd[259703]: Failed password for invalid user jicofo from 146.190.102.53 port 45108 ssh2
Sep 10 16:31:09 nativespace-cdp sshd[259703]: Received disconnect from 146.190.102.53 port 45108:11: Bye Bye [preauth]
Sep 10 16:31:09 nativespace-cdp sshd[259703]: Disconnected from 146.190.102.53 port 45108 [preauth]
Sep 10 16:31:11 nativespace-cdp sshd[259730]: Invalid user automation from 47.238.234.93 port 45850
Sep 10 16:31:11 nativespace-cdp sshd[259730]: input_userauth_request: invalid user automation [preauth]
Sep 10 16:31:11 nativespace-cdp sshd[259730]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:31:11 nativespace-cdp sshd[259730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.238.234.93
Sep 10 16:31:13 nativespace-cdp sshd[259730]: Failed password for invalid user automation from 47.238.234.93 port 45850 ssh2
Sep 10 16:31:14 nativespace-cdp sshd[259730]: Received disconnect from 47.238.234.93 port 45850:11: Bye Bye [preauth]
Sep 10 16:31:14 nativespace-cdp sshd[259730]: Disconnected from 47.238.234.93 port 45850 [preauth]
Sep 10 16:31:33 nativespace-cdp sshd[259838]: Connection closed by 159.100.136.21 port 45138 [preauth]
Sep 10 16:32:58 nativespace-cdp sshd[260207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.111.249.136  user=root
Sep 10 16:32:58 nativespace-cdp sshd[260207]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 16:33:00 nativespace-cdp sshd[260207]: Failed password for root from 190.111.249.136 port 58220 ssh2
Sep 10 16:33:07 nativespace-cdp sshd[260207]: Received disconnect from 190.111.249.136 port 58220:11: Bye Bye [preauth]
Sep 10 16:33:07 nativespace-cdp sshd[260207]: Disconnected from 190.111.249.136 port 58220 [preauth]
Sep 10 16:34:29 nativespace-cdp sshd[260539]: Connection closed by 190.111.249.136 port 45304 [preauth]
Sep 10 16:35:53 nativespace-cdp sshd[260917]: Invalid user dirk from 190.111.249.136 port 60620
Sep 10 16:35:53 nativespace-cdp sshd[260917]: input_userauth_request: invalid user dirk [preauth]
Sep 10 16:35:53 nativespace-cdp sshd[260917]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 16:35:53 nativespace-cdp sshd[260917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.111.249.136
Sep 10 16:35:56 nativespace-cdp sshd[260917]: Failed password for invalid user dirk from 190.111.249.136 port 60620 ssh2
Sep 10 16:35:58 nativespace-cdp sshd[260917]: Received disconnect from 190.111.249.136 port 60620:11: Bye Bye [preauth]
Sep 10 16:35:58 nativespace-cdp sshd[260917]: Disconnected from 190.111.249.136 port 60620 [preauth]
Sep 10 16:36:34 nativespace-cdp sshd[261055]: Connection closed by 159.100.136.21 port 54854 [preauth]
Sep 10 16:41:33 nativespace-cdp sshd[262478]: Connection closed by 159.100.136.21 port 35002 [preauth]
Sep 10 16:46:36 nativespace-cdp sshd[263698]: Connection closed by 159.100.136.21 port 44034 [preauth]
Sep 10 16:51:33 nativespace-cdp sshd[265185]: Connection closed by 159.100.136.21 port 53478 [preauth]
Sep 10 16:56:33 nativespace-cdp sshd[266817]: Connection closed by 159.100.136.21 port 34628 [preauth]
Sep 10 17:01:33 nativespace-cdp sshd[268785]: Connection closed by 159.100.136.21 port 43678 [preauth]
Sep 10 17:06:34 nativespace-cdp sshd[270318]: Connection closed by 159.100.136.21 port 53360 [preauth]
Sep 10 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:09 nativespace-cdp sudo[271241]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:09 nativespace-cdp sudo[271245]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:11 nativespace-cdp sudo[271249]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 17:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:11 nativespace-cdp sudo[271258]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 17:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:33 nativespace-cdp sudo[271261]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 17:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:33 nativespace-cdp sudo[271388]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 17:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:33 nativespace-cdp sudo[271393]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 17:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:33 nativespace-cdp sudo[271397]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 17:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:33 nativespace-cdp sudo[271403]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 17:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:33 nativespace-cdp sudo[271409]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 17:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:33 nativespace-cdp sudo[271414]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 17:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:42 nativespace-cdp sudo[271442]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 17:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:43 nativespace-cdp sudo[271449]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lucy user-2=attlebor user-3=onlycont user-4=ranxterc user-5=outdoorc user-6=hodgsonmail user-7=branko user-8=romaldki user-9=tomandle user-10=jennimil user-11=chrisdal user-12=mcdermos user-13=david user-14=nbhavers user-15=careers user-16=tstardom user-17=oubpgvbx user-18=what user-19=havantho user-20=sketchy user-21=cath user-22=nvihkvu user-23=dancinggardener user-24=stagingerris user-25=ladburyp user-26=kategilpin user-27=design user-28=nove user-29=boldover user-30=bakery user-31=crrtipdl user-32=sosevalu user-33=fawcettd user-34=burydropin user-35=nsceres user-36=beauty user-37=darkstar user-38=eatspam user-39=dhyana user-40=asandcoc user-41=sibtoncc user-42=bwppodcast user-43=zebrapho user-44=steve user-45=cathski user-46=cambria1 user-47=reliable user-48=ninejimm user-49=cwsocial
Sep 10 17:10:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=pugwash user-51=howardon user-52=paulmca1 user-53=hirefootballgame user-54=eugincou user-55=courseme user-56=nscdp user-57=putterfc user-58=leftie user-59=foods user-60=health2045 user-61=fortunaz user-62=lkpier user-63=firstre5 user-64=steakbridieme user-65=donnychicago user-66=philmcph user-67=ctedorgu user-68=smrszyqg user-69=isleofwi user-70=nomistakes user-71=hidden user-72=barbersh user-73=tigerlet user-74=milloyco user-75=gilpin user-76=elecleis user-77=putterfi user-78=hubmaster user-79=fetch user-80=carsinyo user-81=accooper user-82=ianrayne user-83=connectedshoppin user-84=thqkgnbz user-85=ultbcrra user-86=jonhartl user-87=seftvta user-88=firstres user-89=opaiscyx user-90=coursemc user-91=firstrel user-92=clarkass user-93=costestimatorco user-94=firstred user-95=highlegh user-96=southlon user-97=alexadmin user-98=skyfirec user-99=innovat1 user-100=stuartge user-101=askhform user-102=nativene
Sep 10 17:10:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=nstriton user-104=brighto1 user-105=vivienn1 user-106=firstre2 user-107=oneoarco user-108=battlere user-109=bedfords user-110=newstoda user-111=belle user-112=ggaaorgu user-113=bemadonn user-114=jarvisin user-115=spectrum user-116=hodgesonweb user-117=theblack user-118=agproduc user-119=still user-120=stephani user-121=leereyn1 user-122=markward user-123=booff user-124=foundation user-125=vantagep user-126=athenare user-127=connect9 user-128=lbscrmod user-129=maflemin user-130=ulsukarm user-131=martsblo user-132=dickemery123 user-133=ptkxhsbt user-134=hhdugcor user-135=lbhyisi user-136=magichat user-137=lakesan1 user-138=brmrjxl user-139=strathar user-140=atestord user-141=sarafoundation user-142=wilsonsw user-143=megacards user-144=musorguk feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 17:10:43 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 17:10:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:45 nativespace-cdp sudo[271461]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 17:10:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:45 nativespace-cdp sudo[271475]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ZQXoBOekE2DeuVMh.~
Sep 10 17:10:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:45 nativespace-cdp sudo[271481]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ZQXoBOekE2DeuVMh.~'
Sep 10 17:10:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:45 nativespace-cdp sudo[271485]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ZQXoBOekE2DeuVMh.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 17:10:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:45 nativespace-cdp sudo[271491]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 17:10:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:45 nativespace-cdp sudo[271496]: pam_unix(sudo:session): session closed for user root
Sep 10 17:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 17:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 17:10:59 nativespace-cdp sudo[271553]: pam_unix(sudo:session): session closed for user root
Sep 10 17:11:33 nativespace-cdp sshd[271861]: Connection closed by 159.100.136.21 port 34714 [preauth]
Sep 10 17:16:33 nativespace-cdp sshd[273487]: Connection closed by 159.100.136.21 port 44282 [preauth]
Sep 10 17:21:35 nativespace-cdp sshd[274699]: Connection closed by 159.100.136.21 port 53288 [preauth]
Sep 10 17:26:36 nativespace-cdp sshd[276184]: Connection closed by 159.100.136.21 port 34228 [preauth]
Sep 10 17:31:33 nativespace-cdp sshd[277507]: Connection closed by 159.100.136.21 port 43720 [preauth]
Sep 10 17:36:36 nativespace-cdp sshd[278633]: Connection closed by 159.100.136.21 port 52970 [preauth]
Sep 10 17:41:33 nativespace-cdp sshd[280143]: Connection closed by 159.100.136.21 port 34350 [preauth]
Sep 10 17:46:33 nativespace-cdp sshd[281924]: Connection closed by 159.100.136.21 port 43278 [preauth]
Sep 10 17:51:36 nativespace-cdp sshd[283066]: Connection closed by 159.100.136.21 port 52122 [preauth]
Sep 10 17:56:36 nativespace-cdp sshd[284174]: Connection closed by 159.100.136.21 port 33446 [preauth]
Sep 10 18:01:36 nativespace-cdp sshd[285538]: Connection closed by 159.100.136.21 port 42608 [preauth]
Sep 10 18:06:35 nativespace-cdp sshd[287404]: Connection closed by 159.100.136.21 port 52120 [preauth]
Sep 10 18:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 18:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:08 nativespace-cdp sudo[288199]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 18:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:08 nativespace-cdp sudo[288202]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 18:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:10 nativespace-cdp sudo[288205]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 18:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:10 nativespace-cdp sudo[288212]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 18:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:16 nativespace-cdp sudo[288215]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 18:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:16 nativespace-cdp sudo[288245]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 18:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:16 nativespace-cdp sudo[288248]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 18:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:16 nativespace-cdp sudo[288251]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 18:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:16 nativespace-cdp sudo[288254]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 18:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:16 nativespace-cdp sudo[288257]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 18:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:16 nativespace-cdp sudo[288260]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 18:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:18 nativespace-cdp sudo[288271]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 18:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:19 nativespace-cdp sudo[288276]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ptkxhsbt user-2=dickemery123 user-3=martsblo user-4=magichat user-5=hhdugcor user-6=lbhyisi user-7=atestord user-8=sarafoundation user-9=strathar user-10=lakesan1 user-11=brmrjxl user-12=megacards user-13=musorguk user-14=wilsonsw user-15=hodgesonweb user-16=theblack user-17=spectrum user-18=jarvisin user-19=leereyn1 user-20=stephani user-21=agproduc user-22=still user-23=lbscrmod user-24=maflemin user-25=vantagep user-26=athenare user-27=connect9 user-28=booff user-29=foundation user-30=markward user-31=ulsukarm user-32=skyfirec user-33=alexadmin user-34=nativene user-35=askhform user-36=stuartge user-37=innovat1 user-38=oneoarco user-39=battlere user-40=vivienn1 user-41=firstre2 user-42=nstriton user-43=brighto1 user-44=bemadonn user-45=newstoda user-46=belle user-47=ggaaorgu user-48=bedfords
Sep 10 18:10:19 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=fetch user-50=carsinyo user-51=putterfi user-52=hubmaster user-53=elecleis user-54=gilpin user-55=milloyco user-56=thqkgnbz user-57=connectedshoppin user-58=ianrayne user-59=accooper user-60=opaiscyx user-61=coursemc user-62=firstres user-63=ultbcrra user-64=jonhartl user-65=seftvta user-66=highlegh user-67=southlon user-68=firstred user-69=costestimatorco user-70=firstrel user-71=clarkass user-72=cwsocial user-73=pugwash user-74=howardon user-75=paulmca1 user-76=reliable user-77=ninejimm user-78=cambria1 user-79=cathski user-80=courseme user-81=eugincou user-82=hirefootballgame user-83=donnychicago user-84=steakbridieme user-85=firstre5 user-86=ctedorgu user-87=philmcph user-88=lkpier user-89=foods user-90=leftie user-91=fortunaz user-92=health2045 user-93=nscdp user-94=putterfc user-95=tigerlet user-96=barbersh user-97=nomistakes user-98=hidden user-99=isleofwi user-100=smrszyqg user-101=nsceres
Sep 10 18:10:19 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=fawcettd user-103=burydropin user-104=dhyana user-105=darkstar user-106=eatspam user-107=beauty user-108=sibtoncc user-109=asandcoc user-110=steve user-111=zebrapho user-112=bwppodcast user-113=nvihkvu user-114=havantho user-115=sketchy user-116=cath user-117=what user-118=tstardom user-119=oubpgvbx user-120=design user-121=kategilpin user-122=dancinggardener user-123=stagingerris user-124=ladburyp user-125=boldover user-126=nove user-127=crrtipdl user-128=sosevalu user-129=bakery user-130=onlycont user-131=lucy user-132=attlebor user-133=romaldki user-134=branko user-135=outdoorc user-136=hodgsonmail user-137=ranxterc user-138=jennimil user-139=tomandle user-140=david user-141=nbhavers user-142=careers user-143=mcdermos user-144=chrisdal feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 18:10:19 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 18:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:20 nativespace-cdp sudo[288281]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 18:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:20 nativespace-cdp sudo[288287]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-We0PmBQQawoWm0jD.~
Sep 10 18:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:20 nativespace-cdp sudo[288291]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-We0PmBQQawoWm0jD.~'
Sep 10 18:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:20 nativespace-cdp sudo[288294]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-We0PmBQQawoWm0jD.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 18:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:20 nativespace-cdp sudo[288298]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 18:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:20 nativespace-cdp sudo[288301]: pam_unix(sudo:session): session closed for user root
Sep 10 18:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 18:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 18:10:38 nativespace-cdp sudo[288352]: pam_unix(sudo:session): session closed for user root
Sep 10 18:11:34 nativespace-cdp sshd[288895]: Connection closed by 159.100.136.21 port 33180 [preauth]
Sep 10 18:16:33 nativespace-cdp sshd[290174]: Connection closed by 159.100.136.21 port 42844 [preauth]
Sep 10 18:21:33 nativespace-cdp sshd[291454]: Connection closed by 159.100.136.21 port 51768 [preauth]
Sep 10 18:26:33 nativespace-cdp sshd[292841]: Connection closed by 159.100.136.21 port 33068 [preauth]
Sep 10 18:31:34 nativespace-cdp sshd[294571]: Connection closed by 159.100.136.21 port 41078 [preauth]
Sep 10 18:36:33 nativespace-cdp sshd[295790]: Connection closed by 159.100.136.21 port 48520 [preauth]
Sep 10 18:41:33 nativespace-cdp sshd[297149]: Connection closed by 159.100.136.21 port 56828 [preauth]
Sep 10 18:46:33 nativespace-cdp sshd[298933]: Connection closed by 159.100.136.21 port 37614 [preauth]
Sep 10 18:51:34 nativespace-cdp sshd[300275]: Connection closed by 159.100.136.21 port 45574 [preauth]
Sep 10 18:56:33 nativespace-cdp sshd[301925]: Connection closed by 159.100.136.21 port 54820 [preauth]
Sep 10 19:01:35 nativespace-cdp sshd[303261]: Connection closed by 159.100.136.21 port 35676 [preauth]
Sep 10 19:06:33 nativespace-cdp sshd[304457]: Connection closed by 159.100.136.21 port 45222 [preauth]
Sep 10 19:09:28 nativespace-cdp sshd[305119]: Accepted publickey for root from 185.67.178.249 port 46816 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep 10 19:09:28 nativespace-cdp sshd[305119]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep 10 19:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 19:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:10 nativespace-cdp sudo[305395]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 19:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:10 nativespace-cdp sudo[305400]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 19:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:12 nativespace-cdp sudo[305403]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 19:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:12 nativespace-cdp sudo[305413]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 19:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:17 nativespace-cdp sudo[305416]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 19:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:18 nativespace-cdp sudo[305440]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 19:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:18 nativespace-cdp sudo[305443]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 19:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:18 nativespace-cdp sudo[305447]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 19:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:18 nativespace-cdp sudo[305450]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 19:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:18 nativespace-cdp sudo[305453]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 19:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:18 nativespace-cdp sudo[305456]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 19:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:20 nativespace-cdp sudo[305465]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 19:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:21 nativespace-cdp sudo[305470]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=stephani user-2=leereyn1 user-3=agproduc user-4=still user-5=spectrum user-6=hodgesonweb user-7=theblack user-8=jarvisin user-9=ulsukarm user-10=vantagep user-11=athenare user-12=connect9 user-13=lbscrmod user-14=maflemin user-15=booff user-16=foundation user-17=markward user-18=magichat user-19=hhdugcor user-20=lbhyisi user-21=dickemery123 user-22=ptkxhsbt user-23=martsblo user-24=megacards user-25=musorguk user-26=wilsonsw user-27=strathar user-28=atestord user-29=sarafoundation user-30=brmrjxl user-31=lakesan1 user-32=connectedshoppin user-33=thqkgnbz user-34=accooper user-35=ianrayne user-36=hubmaster user-37=putterfi user-38=fetch user-39=carsinyo user-40=milloyco user-41=gilpin user-42=elecleis user-43=firstred user-44=highlegh user-45=southlon user-46=clarkass user-47=firstrel
Sep 10 19:10:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=costestimatorco user-49=opaiscyx user-50=coursemc user-51=ultbcrra user-52=jonhartl user-53=seftvta user-54=firstres user-55=nativene user-56=innovat1 user-57=stuartge user-58=askhform user-59=alexadmin user-60=skyfirec user-61=newstoda user-62=ggaaorgu user-63=belle user-64=bemadonn user-65=bedfords user-66=vivienn1 user-67=firstre2 user-68=oneoarco user-69=battlere user-70=nstriton user-71=brighto1 user-72=dhyana user-73=beauty user-74=darkstar user-75=eatspam user-76=nsceres user-77=fawcettd user-78=burydropin user-79=steve user-80=bwppodcast user-81=zebrapho user-82=asandcoc user-83=sibtoncc user-84=eugincou user-85=courseme user-86=hirefootballgame user-87=cwsocial user-88=paulmca1 user-89=pugwash user-90=howardon user-91=cambria1 user-92=cathski user-93=ninejimm user-94=reliable user-95=nomistakes user-96=hidden user-97=tigerlet user-98=barbersh user-99=smrszyqg user-100=isleofwi user-101=lkpier
Sep 10 19:10:21 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=donnychicago user-103=steakbridieme user-104=firstre5 user-105=philmcph user-106=ctedorgu user-107=nscdp user-108=putterfc user-109=foods user-110=leftie user-111=fortunaz user-112=health2045 user-113=romaldki user-114=outdoorc user-115=ranxterc user-116=hodgsonmail user-117=branko user-118=onlycont user-119=lucy user-120=attlebor user-121=david user-122=nbhavers user-123=careers user-124=chrisdal user-125=mcdermos user-126=jennimil user-127=tomandle user-128=design user-129=stagingerris user-130=dancinggardener user-131=ladburyp user-132=kategilpin user-133=havantho user-134=cath user-135=sketchy user-136=nvihkvu user-137=tstardom user-138=oubpgvbx user-139=what user-140=bakery user-141=crrtipdl user-142=sosevalu user-143=boldover user-144=nove feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 19:10:21 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 19:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:22 nativespace-cdp sudo[305477]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 19:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:23 nativespace-cdp sudo[305485]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cDuUqdTRNiVRZ331.~
Sep 10 19:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:23 nativespace-cdp sudo[305488]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cDuUqdTRNiVRZ331.~'
Sep 10 19:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:23 nativespace-cdp sudo[305491]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cDuUqdTRNiVRZ331.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 19:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:23 nativespace-cdp sudo[305495]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 19:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:23 nativespace-cdp sudo[305499]: pam_unix(sudo:session): session closed for user root
Sep 10 19:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 19:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 19:10:50 nativespace-cdp sudo[305620]: pam_unix(sudo:session): session closed for user root
Sep 10 19:11:28 nativespace-cdp sshd[305119]: pam_unix(sshd:session): session closed for user root
Sep 10 19:11:33 nativespace-cdp sshd[305765]: Connection closed by 159.100.136.21 port 54508 [preauth]
Sep 10 19:16:33 nativespace-cdp sshd[307493]: Connection closed by 159.100.136.21 port 35782 [preauth]
Sep 10 19:21:33 nativespace-cdp sshd[308609]: Connection closed by 159.100.136.21 port 45042 [preauth]
Sep 10 19:26:34 nativespace-cdp sshd[310211]: Connection closed by 159.100.136.21 port 54656 [preauth]
Sep 10 19:31:35 nativespace-cdp sshd[311708]: Connection closed by 159.100.136.21 port 35130 [preauth]
Sep 10 19:36:33 nativespace-cdp sshd[313001]: Connection closed by 159.100.136.21 port 42952 [preauth]
Sep 10 19:41:33 nativespace-cdp sshd[314440]: Connection closed by 159.100.136.21 port 52288 [preauth]
Sep 10 19:46:35 nativespace-cdp sshd[315780]: Connection closed by 159.100.136.21 port 60734 [preauth]
Sep 10 19:51:33 nativespace-cdp sshd[316976]: Connection closed by 159.100.136.21 port 41630 [preauth]
Sep 10 19:56:33 nativespace-cdp sshd[318357]: Connection closed by 159.100.136.21 port 50954 [preauth]
Sep 10 20:01:33 nativespace-cdp sshd[320062]: Connection closed by 159.100.136.21 port 59850 [preauth]
Sep 10 20:06:33 nativespace-cdp sshd[321175]: Connection closed by 159.100.136.21 port 40898 [preauth]
Sep 10 20:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 20:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:09 nativespace-cdp sudo[322037]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 20:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:09 nativespace-cdp sudo[322056]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 20:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:10 nativespace-cdp sudo[322059]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 20:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:10 nativespace-cdp sudo[322073]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 20:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:15 nativespace-cdp sudo[322076]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 20:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:15 nativespace-cdp sudo[322180]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 20:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:15 nativespace-cdp sudo[322183]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 20:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:15 nativespace-cdp sudo[322186]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 20:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:15 nativespace-cdp sudo[322190]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 20:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:15 nativespace-cdp sudo[322193]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 20:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:15 nativespace-cdp sudo[322196]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 20:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:10:17 nativespace-cdp sudo[322267]: pam_unix(sudo:session): session closed for user root
Sep 10 20:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 20:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:11:36 nativespace-cdp sshd[322706]: Connection closed by 159.100.136.21 port 49918 [preauth]
Sep 10 20:16:33 nativespace-cdp sshd[323933]: Connection closed by 159.100.136.21 port 59450 [preauth]
Sep 10 20:16:46 nativespace-cdp sudo[322282]: pam_unix(sudo:session): session closed for user root
Sep 10 20:16:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=what user-2=oubpgvbx user-3=tstardom user-4=nvihkvu user-5=sketchy user-6=cath user-7=havantho user-8=kategilpin user-9=ladburyp user-10=stagingerris user-11=dancinggardener user-12=design user-13=nove user-14=boldover user-15=sosevalu user-16=crrtipdl user-17=bakery user-18=attlebor user-19=lucy user-20=onlycont user-21=branko user-22=outdoorc user-23=ranxterc user-24=hodgsonmail user-25=romaldki user-26=tomandle user-27=jennimil user-28=mcdermos user-29=chrisdal user-30=nbhavers user-31=careers user-32=david user-33=ninejimm user-34=reliable user-35=cambria1 user-36=cathski user-37=pugwash user-38=howardon user-39=paulmca1 user-40=cwsocial user-41=hirefootballgame user-42=courseme user-43=eugincou user-44=fortunaz user-45=health2045 user-46=foods user-47=leftie user-48=putterfc user-49=nscdp
Sep 10 20:16:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=philmcph user-51=ctedorgu user-52=firstre5 user-53=steakbridieme user-54=donnychicago user-55=lkpier user-56=smrszyqg user-57=isleofwi user-58=tigerlet user-59=barbersh user-60=hidden user-61=nomistakes user-62=burydropin user-63=fawcettd user-64=nsceres user-65=eatspam user-66=darkstar user-67=beauty user-68=dhyana user-69=sibtoncc user-70=asandcoc user-71=zebrapho user-72=bwppodcast user-73=steve user-74=alexadmin user-75=skyfirec user-76=askhform user-77=stuartge user-78=innovat1 user-79=nativene user-80=brighto1 user-81=nstriton user-82=battlere user-83=oneoarco user-84=firstre2 user-85=vivienn1 user-86=bedfords user-87=bemadonn user-88=ggaaorgu user-89=belle user-90=newstoda user-91=elecleis user-92=milloyco user-93=gilpin user-94=carsinyo user-95=fetch user-96=putterfi user-97=hubmaster user-98=ianrayne user-99=accooper user-100=thqkgnbz user-101=connectedshoppin user-102=firstres user-103=jonhartl
Sep 10 20:16:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=seftvta user-105=ultbcrra user-106=coursemc user-107=opaiscyx user-108=costestimatorco user-109=firstrel user-110=clarkass user-111=southlon user-112=highlegh user-113=firstred user-114=martsblo user-115=ptkxhsbt user-116=dickemery123 user-117=lbhyisi user-118=hhdugcor user-119=magichat user-120=brmrjxl user-121=lakesan1 user-122=sarafoundation user-123=atestord user-124=strathar user-125=wilsonsw user-126=musorguk user-127=megacards user-128=jarvisin user-129=theblack user-130=hodgesonweb user-131=spectrum user-132=still user-133=agproduc user-134=leereyn1 user-135=stephani user-136=booff user-137=markward user-138=foundation user-139=maflemin user-140=lbscrmod user-141=connect9 user-142=athenare user-143=vantagep user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains feature-9=webprotect
Sep 10 20:16:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 20:16:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:16:47 nativespace-cdp sudo[323983]: pam_unix(sudo:session): session closed for user root
Sep 10 20:16:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 20:16:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:16:48 nativespace-cdp sudo[324027]: pam_unix(sudo:session): session closed for user root
Sep 10 20:16:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-OpVmC9zSTZzFRgK6.~
Sep 10 20:16:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:16:48 nativespace-cdp sudo[324038]: pam_unix(sudo:session): session closed for user root
Sep 10 20:16:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-OpVmC9zSTZzFRgK6.~'
Sep 10 20:16:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:16:48 nativespace-cdp sudo[324042]: pam_unix(sudo:session): session closed for user root
Sep 10 20:16:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-OpVmC9zSTZzFRgK6.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 20:16:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:16:48 nativespace-cdp sudo[324048]: pam_unix(sudo:session): session closed for user root
Sep 10 20:16:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 20:16:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:16:48 nativespace-cdp sudo[324054]: pam_unix(sudo:session): session closed for user root
Sep 10 20:16:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep 10 20:16:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:16:49 nativespace-cdp sudo[324066]: pam_unix(sudo:session): session closed for user root
Sep 10 20:16:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 20:16:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 20:16:59 nativespace-cdp sudo[324136]: pam_unix(sudo:session): session closed for user root
Sep 10 20:21:33 nativespace-cdp sshd[325486]: Connection closed by 159.100.136.21 port 40552 [preauth]
Sep 10 20:26:34 nativespace-cdp sshd[326828]: Connection closed by 159.100.136.21 port 50070 [preauth]
Sep 10 20:31:34 nativespace-cdp sshd[328189]: Connection closed by 159.100.136.21 port 59506 [preauth]
Sep 10 20:36:33 nativespace-cdp sshd[329336]: Connection closed by 159.100.136.21 port 40522 [preauth]
Sep 10 20:41:33 nativespace-cdp sshd[330481]: Connection closed by 159.100.136.21 port 49520 [preauth]
Sep 10 20:43:23 nativespace-cdp sshd[330932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.42.55  user=root
Sep 10 20:43:23 nativespace-cdp sshd[330932]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 20:43:25 nativespace-cdp sshd[330932]: Failed password for root from 47.236.42.55 port 56126 ssh2
Sep 10 20:43:25 nativespace-cdp sshd[330932]: Received disconnect from 47.236.42.55 port 56126:11: Bye Bye [preauth]
Sep 10 20:43:25 nativespace-cdp sshd[330932]: Disconnected from 47.236.42.55 port 56126 [preauth]
Sep 10 20:43:45 nativespace-cdp sshd[331148]: Invalid user radix from 146.190.102.80 port 33394
Sep 10 20:43:45 nativespace-cdp sshd[331148]: input_userauth_request: invalid user radix [preauth]
Sep 10 20:43:45 nativespace-cdp sshd[331148]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 20:43:45 nativespace-cdp sshd[331148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.102.80
Sep 10 20:43:48 nativespace-cdp sshd[331148]: Failed password for invalid user radix from 146.190.102.80 port 33394 ssh2
Sep 10 20:43:51 nativespace-cdp sshd[331148]: Received disconnect from 146.190.102.80 port 33394:11: Bye Bye [preauth]
Sep 10 20:43:51 nativespace-cdp sshd[331148]: Disconnected from 146.190.102.80 port 33394 [preauth]
Sep 10 20:46:32 nativespace-cdp sshd[332305]: Invalid user namrata from 47.236.42.55 port 46434
Sep 10 20:46:32 nativespace-cdp sshd[332305]: input_userauth_request: invalid user namrata [preauth]
Sep 10 20:46:32 nativespace-cdp sshd[332305]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 20:46:32 nativespace-cdp sshd[332305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.42.55
Sep 10 20:46:33 nativespace-cdp sshd[332318]: Connection closed by 159.100.136.21 port 58766 [preauth]
Sep 10 20:46:33 nativespace-cdp sshd[332305]: Failed password for invalid user namrata from 47.236.42.55 port 46434 ssh2
Sep 10 20:46:33 nativespace-cdp sshd[332305]: Received disconnect from 47.236.42.55 port 46434:11: Bye Bye [preauth]
Sep 10 20:46:33 nativespace-cdp sshd[332305]: Disconnected from 47.236.42.55 port 46434 [preauth]
Sep 10 20:46:51 nativespace-cdp sshd[332415]: Invalid user altibase from 47.236.42.55 port 38832
Sep 10 20:46:51 nativespace-cdp sshd[332415]: input_userauth_request: invalid user altibase [preauth]
Sep 10 20:46:51 nativespace-cdp sshd[332415]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 20:46:51 nativespace-cdp sshd[332415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.42.55
Sep 10 20:46:52 nativespace-cdp sshd[332415]: Failed password for invalid user altibase from 47.236.42.55 port 38832 ssh2
Sep 10 20:46:53 nativespace-cdp sshd[332415]: Received disconnect from 47.236.42.55 port 38832:11: Bye Bye [preauth]
Sep 10 20:46:53 nativespace-cdp sshd[332415]: Disconnected from 47.236.42.55 port 38832 [preauth]
Sep 10 20:47:43 nativespace-cdp sshd[332596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.102.80  user=root
Sep 10 20:47:43 nativespace-cdp sshd[332596]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 20:47:46 nativespace-cdp sshd[332596]: Failed password for root from 146.190.102.80 port 42146 ssh2
Sep 10 20:47:46 nativespace-cdp sshd[332596]: Received disconnect from 146.190.102.80 port 42146:11: Bye Bye [preauth]
Sep 10 20:47:46 nativespace-cdp sshd[332596]: Disconnected from 146.190.102.80 port 42146 [preauth]
Sep 10 20:48:43 nativespace-cdp sshd[332771]: Invalid user marian from 146.190.102.80 port 59272
Sep 10 20:48:43 nativespace-cdp sshd[332771]: input_userauth_request: invalid user marian [preauth]
Sep 10 20:48:43 nativespace-cdp sshd[332771]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 20:48:43 nativespace-cdp sshd[332771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.102.80
Sep 10 20:48:45 nativespace-cdp sshd[332771]: Failed password for invalid user marian from 146.190.102.80 port 59272 ssh2
Sep 10 20:48:45 nativespace-cdp sshd[332771]: Received disconnect from 146.190.102.80 port 59272:11: Bye Bye [preauth]
Sep 10 20:48:45 nativespace-cdp sshd[332771]: Disconnected from 146.190.102.80 port 59272 [preauth]
Sep 10 20:51:33 nativespace-cdp sshd[333869]: Connection closed by 159.100.136.21 port 39722 [preauth]
Sep 10 20:56:35 nativespace-cdp sshd[335489]: Connection closed by 159.100.136.21 port 48100 [preauth]
Sep 10 21:01:33 nativespace-cdp sshd[337208]: Connection closed by 159.100.136.21 port 57198 [preauth]
Sep 10 21:04:20 nativespace-cdp sshd[337747]: Invalid user postgres from 103.179.243.194 port 59070
Sep 10 21:04:20 nativespace-cdp sshd[337747]: input_userauth_request: invalid user postgres [preauth]
Sep 10 21:04:20 nativespace-cdp sshd[337747]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:04:20 nativespace-cdp sshd[337747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.243.194
Sep 10 21:04:22 nativespace-cdp sshd[337747]: Failed password for invalid user postgres from 103.179.243.194 port 59070 ssh2
Sep 10 21:04:25 nativespace-cdp sshd[337747]: Received disconnect from 103.179.243.194 port 59070:11: Bye Bye [preauth]
Sep 10 21:04:25 nativespace-cdp sshd[337747]: Disconnected from 103.179.243.194 port 59070 [preauth]
Sep 10 21:04:50 nativespace-cdp sshd[337823]: Invalid user kirill from 157.245.104.97 port 45814
Sep 10 21:04:50 nativespace-cdp sshd[337823]: input_userauth_request: invalid user kirill [preauth]
Sep 10 21:04:50 nativespace-cdp sshd[337823]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:04:50 nativespace-cdp sshd[337823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.104.97
Sep 10 21:04:52 nativespace-cdp sshd[337823]: Failed password for invalid user kirill from 157.245.104.97 port 45814 ssh2
Sep 10 21:04:52 nativespace-cdp sshd[337823]: Received disconnect from 157.245.104.97 port 45814:11: Bye Bye [preauth]
Sep 10 21:04:52 nativespace-cdp sshd[337823]: Disconnected from 157.245.104.97 port 45814 [preauth]
Sep 10 21:05:01 nativespace-cdp sshd[337852]: Invalid user vivek from 187.16.96.250 port 49384
Sep 10 21:05:01 nativespace-cdp sshd[337852]: input_userauth_request: invalid user vivek [preauth]
Sep 10 21:05:01 nativespace-cdp sshd[337852]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:05:01 nativespace-cdp sshd[337852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.16.96.250
Sep 10 21:05:03 nativespace-cdp sshd[337852]: Failed password for invalid user vivek from 187.16.96.250 port 49384 ssh2
Sep 10 21:05:05 nativespace-cdp sshd[337852]: Received disconnect from 187.16.96.250 port 49384:11: Bye Bye [preauth]
Sep 10 21:05:05 nativespace-cdp sshd[337852]: Disconnected from 187.16.96.250 port 49384 [preauth]
Sep 10 21:05:17 nativespace-cdp sshd[338004]: Invalid user secure from 15.235.207.53 port 60168
Sep 10 21:05:17 nativespace-cdp sshd[338004]: input_userauth_request: invalid user secure [preauth]
Sep 10 21:05:17 nativespace-cdp sshd[338004]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:05:17 nativespace-cdp sshd[338004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.235.207.53
Sep 10 21:05:20 nativespace-cdp sshd[338004]: Failed password for invalid user secure from 15.235.207.53 port 60168 ssh2
Sep 10 21:05:20 nativespace-cdp sshd[338004]: Received disconnect from 15.235.207.53 port 60168:11: Bye Bye [preauth]
Sep 10 21:05:20 nativespace-cdp sshd[338004]: Disconnected from 15.235.207.53 port 60168 [preauth]
Sep 10 21:06:16 nativespace-cdp sshd[338254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.4.102.149  user=root
Sep 10 21:06:16 nativespace-cdp sshd[338254]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 21:06:19 nativespace-cdp sshd[338254]: Failed password for root from 61.4.102.149 port 54526 ssh2
Sep 10 21:06:20 nativespace-cdp sshd[338254]: Received disconnect from 61.4.102.149 port 54526:11: Bye Bye [preauth]
Sep 10 21:06:20 nativespace-cdp sshd[338254]: Disconnected from 61.4.102.149 port 54526 [preauth]
Sep 10 21:06:33 nativespace-cdp sshd[338320]: Connection closed by 159.100.136.21 port 37672 [preauth]
Sep 10 21:06:51 nativespace-cdp sshd[338374]: Invalid user advantage from 120.89.98.72 port 56042
Sep 10 21:06:51 nativespace-cdp sshd[338374]: input_userauth_request: invalid user advantage [preauth]
Sep 10 21:06:51 nativespace-cdp sshd[338374]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:06:51 nativespace-cdp sshd[338374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.89.98.72
Sep 10 21:06:53 nativespace-cdp sshd[338374]: Failed password for invalid user advantage from 120.89.98.72 port 56042 ssh2
Sep 10 21:06:53 nativespace-cdp sshd[338374]: Received disconnect from 120.89.98.72 port 56042:11: Bye Bye [preauth]
Sep 10 21:06:53 nativespace-cdp sshd[338374]: Disconnected from 120.89.98.72 port 56042 [preauth]
Sep 10 21:09:02 nativespace-cdp sshd[338838]: Invalid user condor from 23.158.56.251 port 56780
Sep 10 21:09:02 nativespace-cdp sshd[338838]: input_userauth_request: invalid user condor [preauth]
Sep 10 21:09:02 nativespace-cdp sshd[338838]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:09:02 nativespace-cdp sshd[338838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.158.56.251
Sep 10 21:09:04 nativespace-cdp sshd[338838]: Failed password for invalid user condor from 23.158.56.251 port 56780 ssh2
Sep 10 21:09:05 nativespace-cdp sshd[338838]: Received disconnect from 23.158.56.251 port 56780:11: Bye Bye [preauth]
Sep 10 21:09:05 nativespace-cdp sshd[338838]: Disconnected from 23.158.56.251 port 56780 [preauth]
Sep 10 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:08 nativespace-cdp sudo[339301]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:08 nativespace-cdp sudo[339306]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:11 nativespace-cdp sudo[339311]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 21:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:11 nativespace-cdp sudo[339322]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 21:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:13 nativespace-cdp sshd[339334]: Invalid user pydio from 49.229.102.187 port 37876
Sep 10 21:10:13 nativespace-cdp sshd[339334]: input_userauth_request: invalid user pydio [preauth]
Sep 10 21:10:13 nativespace-cdp sshd[339334]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:10:13 nativespace-cdp sshd[339334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.229.102.187
Sep 10 21:10:15 nativespace-cdp sshd[339334]: Failed password for invalid user pydio from 49.229.102.187 port 37876 ssh2
Sep 10 21:10:15 nativespace-cdp sudo[339328]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:15 nativespace-cdp sshd[339334]: Received disconnect from 49.229.102.187 port 37876:11: Bye Bye [preauth]
Sep 10 21:10:15 nativespace-cdp sshd[339334]: Disconnected from 49.229.102.187 port 37876 [preauth]
Sep 10 21:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 21:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:15 nativespace-cdp sudo[339350]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 21:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:15 nativespace-cdp sudo[339355]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 21:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:15 nativespace-cdp sudo[339359]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 21:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:15 nativespace-cdp sudo[339365]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 21:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:15 nativespace-cdp sudo[339371]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 21:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:15 nativespace-cdp sudo[339376]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 21:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:26 nativespace-cdp sudo[339405]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 21:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:26 nativespace-cdp sudo[339412]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=putterfc user-2=nscdp user-3=health2045 user-4=fortunaz user-5=foods user-6=leftie user-7=lkpier user-8=ctedorgu user-9=philmcph user-10=firstre5 user-11=steakbridieme user-12=donnychicago user-13=isleofwi user-14=smrszyqg user-15=hidden user-16=nomistakes user-17=tigerlet user-18=barbersh user-19=cathski user-20=cambria1 user-21=reliable user-22=ninejimm user-23=howardon user-24=pugwash user-25=paulmca1 user-26=cwsocial user-27=hirefootballgame user-28=eugincou user-29=courseme user-30=asandcoc user-31=sibtoncc user-32=bwppodcast user-33=zebrapho user-34=steve user-35=burydropin user-36=fawcettd user-37=nsceres user-38=beauty user-39=eatspam user-40=darkstar user-41=dhyana user-42=nove user-43=boldover user-44=bakery user-45=sosevalu user-46=crrtipdl user-47=oubpgvbx user-48=tstardom
Sep 10 21:10:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=what user-50=sketchy user-51=cath user-52=havantho user-53=nvihkvu user-54=ladburyp user-55=stagingerris user-56=dancinggardener user-57=kategilpin user-58=design user-59=tomandle user-60=jennimil user-61=chrisdal user-62=mcdermos user-63=careers user-64=nbhavers user-65=david user-66=attlebor user-67=lucy user-68=onlycont user-69=hodgsonmail user-70=outdoorc user-71=ranxterc user-72=branko user-73=romaldki user-74=brmrjxl user-75=lakesan1 user-76=strathar user-77=sarafoundation user-78=atestord user-79=wilsonsw user-80=musorguk user-81=megacards user-82=martsblo user-83=dickemery123 user-84=ptkxhsbt user-85=lbhyisi user-86=hhdugcor user-87=magichat user-88=markward user-89=booff user-90=foundation user-91=athenare user-92=connect9 user-93=vantagep user-94=maflemin user-95=lbscrmod user-96=ulsukarm user-97=jarvisin user-98=spectrum user-99=hodgesonweb user-100=theblack user-101=still user-102=agproduc
Sep 10 21:10:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=stephani user-104=leereyn1 user-105=brighto1 user-106=nstriton user-107=firstre2 user-108=vivienn1 user-109=battlere user-110=oneoarco user-111=bedfords user-112=ggaaorgu user-113=belle user-114=newstoda user-115=bemadonn user-116=skyfirec user-117=alexadmin user-118=innovat1 user-119=stuartge user-120=askhform user-121=nativene user-122=jonhartl user-123=seftvta user-124=ultbcrra user-125=firstres user-126=coursemc user-127=opaiscyx user-128=clarkass user-129=firstrel user-130=costestimatorco user-131=firstred user-132=southlon user-133=highlegh user-134=milloyco user-135=gilpin user-136=elecleis user-137=putterfi user-138=hubmaster user-139=carsinyo user-140=fetch user-141=accooper user-142=ianrayne user-143=connectedshoppin user-144=thqkgnbz feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 21:10:26 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 21:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:27 nativespace-cdp sudo[339418]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 21:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:28 nativespace-cdp sudo[339426]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vVzyvr3SDeb3UxuB.~
Sep 10 21:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:28 nativespace-cdp sudo[339431]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vVzyvr3SDeb3UxuB.~'
Sep 10 21:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:28 nativespace-cdp sudo[339436]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vVzyvr3SDeb3UxuB.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 21:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:28 nativespace-cdp sudo[339442]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 21:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:28 nativespace-cdp sudo[339447]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:35 nativespace-cdp sshd[339468]: Invalid user arthur from 157.245.104.97 port 38862
Sep 10 21:10:35 nativespace-cdp sshd[339468]: input_userauth_request: invalid user arthur [preauth]
Sep 10 21:10:35 nativespace-cdp sshd[339468]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:10:35 nativespace-cdp sshd[339468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.104.97
Sep 10 21:10:37 nativespace-cdp sshd[339468]: Failed password for invalid user arthur from 157.245.104.97 port 38862 ssh2
Sep 10 21:10:37 nativespace-cdp sshd[339468]: Received disconnect from 157.245.104.97 port 38862:11: Bye Bye [preauth]
Sep 10 21:10:37 nativespace-cdp sshd[339468]: Disconnected from 157.245.104.97 port 38862 [preauth]
Sep 10 21:10:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 21:10:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:10:41 nativespace-cdp sudo[339499]: pam_unix(sudo:session): session closed for user root
Sep 10 21:10:42 nativespace-cdp sshd[339502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.16.96.250  user=root
Sep 10 21:10:42 nativespace-cdp sshd[339502]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 21:10:43 nativespace-cdp sshd[339502]: Failed password for root from 187.16.96.250 port 39536 ssh2
Sep 10 21:10:47 nativespace-cdp sshd[339502]: Received disconnect from 187.16.96.250 port 39536:11: Bye Bye [preauth]
Sep 10 21:10:47 nativespace-cdp sshd[339502]: Disconnected from 187.16.96.250 port 39536 [preauth]
Sep 10 21:11:12 nativespace-cdp sshd[339595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.243.194  user=root
Sep 10 21:11:12 nativespace-cdp sshd[339595]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 21:11:13 nativespace-cdp sshd[339595]: Failed password for root from 103.179.243.194 port 55552 ssh2
Sep 10 21:11:14 nativespace-cdp sshd[339595]: Received disconnect from 103.179.243.194 port 55552:11: Bye Bye [preauth]
Sep 10 21:11:14 nativespace-cdp sshd[339595]: Disconnected from 103.179.243.194 port 55552 [preauth]
Sep 10 21:11:23 nativespace-cdp sshd[339628]: Invalid user testuser2 from 157.245.104.97 port 48186
Sep 10 21:11:23 nativespace-cdp sshd[339628]: input_userauth_request: invalid user testuser2 [preauth]
Sep 10 21:11:23 nativespace-cdp sshd[339628]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:11:23 nativespace-cdp sshd[339628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.104.97
Sep 10 21:11:25 nativespace-cdp sshd[339704]: Invalid user bioinfo from 61.4.102.149 port 39134
Sep 10 21:11:25 nativespace-cdp sshd[339704]: input_userauth_request: invalid user bioinfo [preauth]
Sep 10 21:11:25 nativespace-cdp sshd[339704]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:11:25 nativespace-cdp sshd[339704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.4.102.149
Sep 10 21:11:25 nativespace-cdp sshd[339628]: Failed password for invalid user testuser2 from 157.245.104.97 port 48186 ssh2
Sep 10 21:11:25 nativespace-cdp sshd[339628]: Received disconnect from 157.245.104.97 port 48186:11: Bye Bye [preauth]
Sep 10 21:11:25 nativespace-cdp sshd[339628]: Disconnected from 157.245.104.97 port 48186 [preauth]
Sep 10 21:11:27 nativespace-cdp sshd[339704]: Failed password for invalid user bioinfo from 61.4.102.149 port 39134 ssh2
Sep 10 21:11:29 nativespace-cdp sshd[339704]: Received disconnect from 61.4.102.149 port 39134:11: Bye Bye [preauth]
Sep 10 21:11:29 nativespace-cdp sshd[339704]: Disconnected from 61.4.102.149 port 39134 [preauth]
Sep 10 21:11:33 nativespace-cdp sshd[339808]: Connection closed by 159.100.136.21 port 47190 [preauth]
Sep 10 21:11:43 nativespace-cdp sshd[339833]: Connection closed by 187.16.96.250 port 44172 [preauth]
Sep 10 21:12:03 nativespace-cdp sshd[340224]: Invalid user jiaxuan from 15.235.207.53 port 54594
Sep 10 21:12:03 nativespace-cdp sshd[340224]: input_userauth_request: invalid user jiaxuan [preauth]
Sep 10 21:12:03 nativespace-cdp sshd[340224]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:12:03 nativespace-cdp sshd[340224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.235.207.53
Sep 10 21:12:04 nativespace-cdp sshd[340227]: Invalid user strapi from 49.229.102.187 port 34736
Sep 10 21:12:04 nativespace-cdp sshd[340227]: input_userauth_request: invalid user strapi [preauth]
Sep 10 21:12:04 nativespace-cdp sshd[340227]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:12:04 nativespace-cdp sshd[340227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.229.102.187
Sep 10 21:12:05 nativespace-cdp sshd[340224]: Failed password for invalid user jiaxuan from 15.235.207.53 port 54594 ssh2
Sep 10 21:12:05 nativespace-cdp sshd[340224]: Received disconnect from 15.235.207.53 port 54594:11: Bye Bye [preauth]
Sep 10 21:12:05 nativespace-cdp sshd[340224]: Disconnected from 15.235.207.53 port 54594 [preauth]
Sep 10 21:12:06 nativespace-cdp sshd[340227]: Failed password for invalid user strapi from 49.229.102.187 port 34736 ssh2
Sep 10 21:12:06 nativespace-cdp sshd[340227]: Received disconnect from 49.229.102.187 port 34736:11: Bye Bye [preauth]
Sep 10 21:12:06 nativespace-cdp sshd[340227]: Disconnected from 49.229.102.187 port 34736 [preauth]
Sep 10 21:12:14 nativespace-cdp sshd[340250]: Invalid user cxy from 61.4.102.149 port 53098
Sep 10 21:12:14 nativespace-cdp sshd[340250]: input_userauth_request: invalid user cxy [preauth]
Sep 10 21:12:14 nativespace-cdp sshd[340250]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:12:14 nativespace-cdp sshd[340250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.4.102.149
Sep 10 21:12:15 nativespace-cdp sshd[340250]: Failed password for invalid user cxy from 61.4.102.149 port 53098 ssh2
Sep 10 21:12:15 nativespace-cdp sshd[340250]: Received disconnect from 61.4.102.149 port 53098:11: Bye Bye [preauth]
Sep 10 21:12:15 nativespace-cdp sshd[340250]: Disconnected from 61.4.102.149 port 53098 [preauth]
Sep 10 21:12:16 nativespace-cdp sshd[340264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.25.236.192  user=root
Sep 10 21:12:16 nativespace-cdp sshd[340264]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 21:12:18 nativespace-cdp sshd[340264]: Failed password for root from 46.25.236.192 port 49142 ssh2
Sep 10 21:12:18 nativespace-cdp sshd[340264]: Received disconnect from 46.25.236.192 port 49142:11: Bye Bye [preauth]
Sep 10 21:12:18 nativespace-cdp sshd[340264]: Disconnected from 46.25.236.192 port 49142 [preauth]
Sep 10 21:12:28 nativespace-cdp sshd[340324]: Invalid user pydio from 187.16.96.250 port 38016
Sep 10 21:12:28 nativespace-cdp sshd[340324]: input_userauth_request: invalid user pydio [preauth]
Sep 10 21:12:28 nativespace-cdp sshd[340324]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:12:28 nativespace-cdp sshd[340324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.16.96.250
Sep 10 21:12:30 nativespace-cdp sshd[340324]: Failed password for invalid user pydio from 187.16.96.250 port 38016 ssh2
Sep 10 21:12:30 nativespace-cdp sshd[340324]: Received disconnect from 187.16.96.250 port 38016:11: Bye Bye [preauth]
Sep 10 21:12:30 nativespace-cdp sshd[340324]: Disconnected from 187.16.96.250 port 38016 [preauth]
Sep 10 21:12:31 nativespace-cdp sshd[340334]: Invalid user user2 from 103.179.243.194 port 42966
Sep 10 21:12:31 nativespace-cdp sshd[340334]: input_userauth_request: invalid user user2 [preauth]
Sep 10 21:12:31 nativespace-cdp sshd[340334]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:12:31 nativespace-cdp sshd[340334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.179.243.194
Sep 10 21:12:33 nativespace-cdp sshd[340334]: Failed password for invalid user user2 from 103.179.243.194 port 42966 ssh2
Sep 10 21:12:33 nativespace-cdp sshd[340334]: Received disconnect from 103.179.243.194 port 42966:11: Bye Bye [preauth]
Sep 10 21:12:33 nativespace-cdp sshd[340334]: Disconnected from 103.179.243.194 port 42966 [preauth]
Sep 10 21:12:52 nativespace-cdp sshd[340463]: Invalid user database from 15.235.207.53 port 42776
Sep 10 21:12:52 nativespace-cdp sshd[340463]: input_userauth_request: invalid user database [preauth]
Sep 10 21:12:52 nativespace-cdp sshd[340463]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:12:52 nativespace-cdp sshd[340463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.235.207.53
Sep 10 21:12:54 nativespace-cdp sshd[340463]: Failed password for invalid user database from 15.235.207.53 port 42776 ssh2
Sep 10 21:13:01 nativespace-cdp sshd[340520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.229.102.187  user=root
Sep 10 21:13:01 nativespace-cdp sshd[340520]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 21:13:03 nativespace-cdp sshd[340520]: Failed password for root from 49.229.102.187 port 55894 ssh2
Sep 10 21:13:03 nativespace-cdp sshd[340520]: Received disconnect from 49.229.102.187 port 55894:11: Bye Bye [preauth]
Sep 10 21:13:03 nativespace-cdp sshd[340520]: Disconnected from 49.229.102.187 port 55894 [preauth]
Sep 10 21:13:36 nativespace-cdp sshd[340668]: Invalid user pawan from 163.172.155.110 port 49922
Sep 10 21:13:36 nativespace-cdp sshd[340668]: input_userauth_request: invalid user pawan [preauth]
Sep 10 21:13:36 nativespace-cdp sshd[340668]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:13:36 nativespace-cdp sshd[340668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.172.155.110
Sep 10 21:13:38 nativespace-cdp sshd[340668]: Failed password for invalid user pawan from 163.172.155.110 port 49922 ssh2
Sep 10 21:13:38 nativespace-cdp sshd[340668]: Received disconnect from 163.172.155.110 port 49922:11: Bye Bye [preauth]
Sep 10 21:13:38 nativespace-cdp sshd[340668]: Disconnected from 163.172.155.110 port 49922 [preauth]
Sep 10 21:14:58 nativespace-cdp sshd[340978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.89.98.72  user=root
Sep 10 21:14:58 nativespace-cdp sshd[340978]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 21:15:00 nativespace-cdp sshd[340978]: Failed password for root from 120.89.98.72 port 49878 ssh2
Sep 10 21:15:03 nativespace-cdp sshd[340978]: Received disconnect from 120.89.98.72 port 49878:11: Bye Bye [preauth]
Sep 10 21:15:03 nativespace-cdp sshd[340978]: Disconnected from 120.89.98.72 port 49878 [preauth]
Sep 10 21:15:04 nativespace-cdp sshd[341123]: Invalid user cam from 163.172.155.110 port 39266
Sep 10 21:15:04 nativespace-cdp sshd[341123]: input_userauth_request: invalid user cam [preauth]
Sep 10 21:15:04 nativespace-cdp sshd[341123]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:15:04 nativespace-cdp sshd[341123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.172.155.110
Sep 10 21:15:06 nativespace-cdp sshd[341123]: Failed password for invalid user cam from 163.172.155.110 port 39266 ssh2
Sep 10 21:15:06 nativespace-cdp sshd[341123]: Received disconnect from 163.172.155.110 port 39266:11: Bye Bye [preauth]
Sep 10 21:15:06 nativespace-cdp sshd[341123]: Disconnected from 163.172.155.110 port 39266 [preauth]
Sep 10 21:15:43 nativespace-cdp sshd[341270]: Invalid user chenlei from 163.172.155.110 port 52250
Sep 10 21:15:43 nativespace-cdp sshd[341270]: input_userauth_request: invalid user chenlei [preauth]
Sep 10 21:15:43 nativespace-cdp sshd[341270]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:15:43 nativespace-cdp sshd[341270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.172.155.110
Sep 10 21:15:45 nativespace-cdp sshd[341270]: Failed password for invalid user chenlei from 163.172.155.110 port 52250 ssh2
Sep 10 21:15:45 nativespace-cdp sshd[341270]: Received disconnect from 163.172.155.110 port 52250:11: Bye Bye [preauth]
Sep 10 21:15:45 nativespace-cdp sshd[341270]: Disconnected from 163.172.155.110 port 52250 [preauth]
Sep 10 21:15:55 nativespace-cdp sshd[341279]: Connection closed by 46.25.236.192 port 48348 [preauth]
Sep 10 21:15:58 nativespace-cdp sshd[341352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.89.98.72  user=root
Sep 10 21:15:58 nativespace-cdp sshd[341352]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 21:16:00 nativespace-cdp sshd[341352]: Failed password for root from 120.89.98.72 port 40708 ssh2
Sep 10 21:16:00 nativespace-cdp sshd[341352]: Received disconnect from 120.89.98.72 port 40708:11: Bye Bye [preauth]
Sep 10 21:16:00 nativespace-cdp sshd[341352]: Disconnected from 120.89.98.72 port 40708 [preauth]
Sep 10 21:16:30 nativespace-cdp sshd[341479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.158.56.251  user=root
Sep 10 21:16:30 nativespace-cdp sshd[341479]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 21:16:33 nativespace-cdp sshd[341479]: Failed password for root from 23.158.56.251 port 56042 ssh2
Sep 10 21:16:34 nativespace-cdp sshd[341479]: Received disconnect from 23.158.56.251 port 56042:11: Bye Bye [preauth]
Sep 10 21:16:34 nativespace-cdp sshd[341479]: Disconnected from 23.158.56.251 port 56042 [preauth]
Sep 10 21:16:35 nativespace-cdp sshd[341491]: Connection closed by 159.100.136.21 port 56078 [preauth]
Sep 10 21:17:28 nativespace-cdp sshd[341625]: Connection closed by 46.25.236.192 port 35216 [preauth]
Sep 10 21:18:01 nativespace-cdp sshd[341723]: Invalid user szj from 23.158.56.251 port 41194
Sep 10 21:18:01 nativespace-cdp sshd[341723]: input_userauth_request: invalid user szj [preauth]
Sep 10 21:18:01 nativespace-cdp sshd[341723]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:18:01 nativespace-cdp sshd[341723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.158.56.251
Sep 10 21:18:03 nativespace-cdp sshd[341723]: Failed password for invalid user szj from 23.158.56.251 port 41194 ssh2
Sep 10 21:18:03 nativespace-cdp sshd[341723]: Received disconnect from 23.158.56.251 port 41194:11: Bye Bye [preauth]
Sep 10 21:18:03 nativespace-cdp sshd[341723]: Disconnected from 23.158.56.251 port 41194 [preauth]
Sep 10 21:19:02 nativespace-cdp sshd[341965]: Invalid user master from 46.25.236.192 port 50252
Sep 10 21:19:02 nativespace-cdp sshd[341965]: input_userauth_request: invalid user master [preauth]
Sep 10 21:19:02 nativespace-cdp sshd[341965]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 21:19:02 nativespace-cdp sshd[341965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.25.236.192
Sep 10 21:19:04 nativespace-cdp sshd[341965]: Failed password for invalid user master from 46.25.236.192 port 50252 ssh2
Sep 10 21:19:04 nativespace-cdp sshd[341965]: Received disconnect from 46.25.236.192 port 50252:11: Bye Bye [preauth]
Sep 10 21:19:04 nativespace-cdp sshd[341965]: Disconnected from 46.25.236.192 port 50252 [preauth]
Sep 10 21:21:10 nativespace-cdp sshd[342612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.25.236.192  user=root
Sep 10 21:21:10 nativespace-cdp sshd[342612]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 21:21:12 nativespace-cdp sshd[342612]: Failed password for root from 46.25.236.192 port 37062 ssh2
Sep 10 21:21:16 nativespace-cdp sshd[342612]: Received disconnect from 46.25.236.192 port 37062:11: Bye Bye [preauth]
Sep 10 21:21:16 nativespace-cdp sshd[342612]: Disconnected from 46.25.236.192 port 37062 [preauth]
Sep 10 21:21:36 nativespace-cdp sshd[342717]: Connection closed by 159.100.136.21 port 37060 [preauth]
Sep 10 21:26:35 nativespace-cdp sshd[343907]: Connection closed by 159.100.136.21 port 46504 [preauth]
Sep 10 21:31:34 nativespace-cdp sshd[345515]: Connection closed by 159.100.136.21 port 55598 [preauth]
Sep 10 21:36:34 nativespace-cdp sshd[346606]: Connection closed by 159.100.136.21 port 37098 [preauth]
Sep 10 21:41:33 nativespace-cdp sshd[347980]: Connection closed by 159.100.136.21 port 44830 [preauth]
Sep 10 21:42:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 21:42:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:42:07 nativespace-cdp sudo[348082]: pam_unix(sudo:session): session closed for user root
Sep 10 21:42:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status tigerlet
Sep 10 21:42:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 21:42:08 nativespace-cdp sudo[348087]: pam_unix(sudo:session): session closed for user root
Sep 10 21:46:35 nativespace-cdp sshd[349396]: Connection closed by 159.100.136.21 port 54564 [preauth]
Sep 10 21:51:34 nativespace-cdp sshd[350631]: Connection closed by 159.100.136.21 port 35720 [preauth]
Sep 10 21:56:33 nativespace-cdp sshd[351850]: Connection closed by 159.100.136.21 port 45394 [preauth]
Sep 10 22:01:38 nativespace-cdp sshd[353680]: Connection closed by 159.100.136.21 port 52424 [preauth]
Sep 10 22:06:35 nativespace-cdp sshd[354753]: Connection closed by 159.100.136.21 port 33042 [preauth]
Sep 10 22:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 22:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:11 nativespace-cdp sudo[355581]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 22:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:11 nativespace-cdp sudo[355585]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 22:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:12 nativespace-cdp sudo[355588]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 22:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:12 nativespace-cdp sudo[355597]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 22:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:16 nativespace-cdp sudo[355600]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 22:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:16 nativespace-cdp sudo[355622]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 22:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:16 nativespace-cdp sudo[355625]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 22:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:16 nativespace-cdp sudo[355628]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 22:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:16 nativespace-cdp sudo[355631]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 22:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:16 nativespace-cdp sudo[355635]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 22:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:17 nativespace-cdp sudo[355638]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 22:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:24 nativespace-cdp sudo[355655]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 22:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:25 nativespace-cdp sudo[355660]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=hodgesonweb user-3=theblack user-4=spectrum user-5=agproduc user-6=still user-7=leereyn1 user-8=stephani user-9=booff user-10=foundation user-11=markward user-12=lbscrmod user-13=maflemin user-14=vantagep user-15=connect9 user-16=athenare user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=hhdugcor user-22=lbhyisi user-23=magichat user-24=lakesan1 user-25=brmrjxl user-26=atestord user-27=sarafoundation user-28=strathar user-29=wilsonsw user-30=megacards user-31=musorguk user-32=elecleis user-33=gilpin user-34=milloyco user-35=fetch user-36=carsinyo user-37=putterfi user-38=hubmaster user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=ultbcrra user-45=seftvta user-46=jonhartl user-47=coursemc
Sep 10 22:10:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=opaiscyx user-49=costestimatorco user-50=firstrel user-51=clarkass user-52=highlegh user-53=southlon user-54=firstred user-55=skyfirec user-56=alexadmin user-57=stuartge user-58=askhform user-59=innovat1 user-60=nativene user-61=nstriton user-62=brighto1 user-63=oneoarco user-64=battlere user-65=vivienn1 user-66=firstre2 user-67=bedfords user-68=bemadonn user-69=newstoda user-70=belle user-71=ggaaorgu user-72=fawcettd user-73=burydropin user-74=nsceres user-75=darkstar user-76=eatspam user-77=beauty user-78=dhyana user-79=sibtoncc user-80=asandcoc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=reliable user-85=ninejimm user-86=cambria1 user-87=cathski user-88=cwsocial user-89=paulmca1 user-90=howardon user-91=pugwash user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=foods user-96=leftie user-97=health2045 user-98=fortunaz user-99=nscdp user-100=putterfc user-101=steakbridieme
Sep 10 22:10:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=firstre5 user-103=donnychicago user-104=ctedorgu user-105=philmcph user-106=lkpier user-107=smrszyqg user-108=isleofwi user-109=tigerlet user-110=barbersh user-111=nomistakes user-112=hidden user-113=lucy user-114=attlebor user-115=onlycont user-116=branko user-117=hodgsonmail user-118=ranxterc user-119=outdoorc user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=david user-126=nbhavers user-127=careers user-128=what user-129=oubpgvbx user-130=tstardom user-131=nvihkvu user-132=havantho user-133=sketchy user-134=cath user-135=kategilpin user-136=dancinggardener user-137=stagingerris user-138=ladburyp user-139=design user-140=nove user-141=boldover user-142=crrtipdl user-143=sosevalu user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 10 22:10:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 22:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:26 nativespace-cdp sudo[355666]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 22:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:26 nativespace-cdp sudo[355678]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-RfXad8WXhawwHtV3.~
Sep 10 22:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:27 nativespace-cdp sudo[355681]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-RfXad8WXhawwHtV3.~'
Sep 10 22:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:27 nativespace-cdp sudo[355684]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-RfXad8WXhawwHtV3.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 22:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:27 nativespace-cdp sudo[355688]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 22:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:27 nativespace-cdp sudo[355691]: pam_unix(sudo:session): session closed for user root
Sep 10 22:10:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 22:10:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 22:10:44 nativespace-cdp sudo[355794]: pam_unix(sudo:session): session closed for user root
Sep 10 22:11:35 nativespace-cdp sshd[355967]: Connection closed by 159.100.136.21 port 42336 [preauth]
Sep 10 22:16:33 nativespace-cdp sshd[357273]: Connection closed by 159.100.136.21 port 51922 [preauth]
Sep 10 22:21:33 nativespace-cdp sshd[358712]: Connection closed by 159.100.136.21 port 60980 [preauth]
Sep 10 22:26:33 nativespace-cdp sshd[360100]: Connection closed by 159.100.136.21 port 42530 [preauth]
Sep 10 22:31:33 nativespace-cdp sshd[361876]: Connection closed by 159.100.136.21 port 51810 [preauth]
Sep 10 22:32:35 nativespace-cdp sshd[362118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.26.47.38  user=root
Sep 10 22:32:35 nativespace-cdp sshd[362118]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 22:32:37 nativespace-cdp sshd[362118]: Failed password for root from 195.26.47.38 port 45178 ssh2
Sep 10 22:32:40 nativespace-cdp sshd[362118]: Received disconnect from 195.26.47.38 port 45178:11: Bye Bye [preauth]
Sep 10 22:32:40 nativespace-cdp sshd[362118]: Disconnected from 195.26.47.38 port 45178 [preauth]
Sep 10 22:34:31 nativespace-cdp sshd[362509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.247.191.252  user=root
Sep 10 22:34:31 nativespace-cdp sshd[362509]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 22:34:33 nativespace-cdp sshd[362509]: Failed password for root from 84.247.191.252 port 48326 ssh2
Sep 10 22:34:33 nativespace-cdp sshd[362509]: Received disconnect from 84.247.191.252 port 48326:11: Bye Bye [preauth]
Sep 10 22:34:33 nativespace-cdp sshd[362509]: Disconnected from 84.247.191.252 port 48326 [preauth]
Sep 10 22:34:41 nativespace-cdp sshd[362525]: Invalid user f from 59.3.76.218 port 42512
Sep 10 22:34:41 nativespace-cdp sshd[362525]: input_userauth_request: invalid user f [preauth]
Sep 10 22:34:41 nativespace-cdp sshd[362525]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:34:41 nativespace-cdp sshd[362525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.3.76.218
Sep 10 22:34:43 nativespace-cdp sshd[362525]: Failed password for invalid user f from 59.3.76.218 port 42512 ssh2
Sep 10 22:34:43 nativespace-cdp sshd[362525]: Received disconnect from 59.3.76.218 port 42512:11: Bye Bye [preauth]
Sep 10 22:34:43 nativespace-cdp sshd[362525]: Disconnected from 59.3.76.218 port 42512 [preauth]
Sep 10 22:36:33 nativespace-cdp sshd[363060]: Connection closed by 159.100.136.21 port 33224 [preauth]
Sep 10 22:37:04 nativespace-cdp sshd[363138]: Invalid user fabior from 206.217.133.9 port 34766
Sep 10 22:37:04 nativespace-cdp sshd[363138]: input_userauth_request: invalid user fabior [preauth]
Sep 10 22:37:04 nativespace-cdp sshd[363138]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:37:04 nativespace-cdp sshd[363138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.217.133.9
Sep 10 22:37:06 nativespace-cdp sshd[363138]: Failed password for invalid user fabior from 206.217.133.9 port 34766 ssh2
Sep 10 22:37:06 nativespace-cdp sshd[363138]: Received disconnect from 206.217.133.9 port 34766:11: Bye Bye [preauth]
Sep 10 22:37:06 nativespace-cdp sshd[363138]: Disconnected from 206.217.133.9 port 34766 [preauth]
Sep 10 22:39:48 nativespace-cdp sshd[363592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.103.169.12  user=root
Sep 10 22:39:48 nativespace-cdp sshd[363592]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 22:39:51 nativespace-cdp sshd[363592]: Failed password for root from 186.103.169.12 port 53590 ssh2
Sep 10 22:39:51 nativespace-cdp sshd[363592]: Received disconnect from 186.103.169.12 port 53590:11: Bye Bye [preauth]
Sep 10 22:39:51 nativespace-cdp sshd[363592]: Disconnected from 186.103.169.12 port 53590 [preauth]
Sep 10 22:39:51 nativespace-cdp sshd[363606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.26.47.38  user=root
Sep 10 22:39:51 nativespace-cdp sshd[363606]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 22:39:53 nativespace-cdp sshd[363606]: Failed password for root from 195.26.47.38 port 34088 ssh2
Sep 10 22:39:53 nativespace-cdp sshd[363606]: Received disconnect from 195.26.47.38 port 34088:11: Bye Bye [preauth]
Sep 10 22:39:53 nativespace-cdp sshd[363606]: Disconnected from 195.26.47.38 port 34088 [preauth]
Sep 10 22:39:56 nativespace-cdp sshd[363712]: Invalid user postgres from 36.92.107.125 port 35210
Sep 10 22:39:56 nativespace-cdp sshd[363712]: input_userauth_request: invalid user postgres [preauth]
Sep 10 22:39:56 nativespace-cdp sshd[363712]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:39:56 nativespace-cdp sshd[363712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.92.107.125
Sep 10 22:39:58 nativespace-cdp sshd[363712]: Failed password for invalid user postgres from 36.92.107.125 port 35210 ssh2
Sep 10 22:40:06 nativespace-cdp sshd[363859]: Invalid user ts3 from 84.247.191.252 port 48496
Sep 10 22:40:06 nativespace-cdp sshd[363859]: input_userauth_request: invalid user ts3 [preauth]
Sep 10 22:40:06 nativespace-cdp sshd[363859]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:40:06 nativespace-cdp sshd[363859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.247.191.252
Sep 10 22:40:09 nativespace-cdp sshd[363712]: Received disconnect from 36.92.107.125 port 35210:11: Bye Bye [preauth]
Sep 10 22:40:09 nativespace-cdp sshd[363712]: Disconnected from 36.92.107.125 port 35210 [preauth]
Sep 10 22:40:09 nativespace-cdp sshd[363859]: Failed password for invalid user ts3 from 84.247.191.252 port 48496 ssh2
Sep 10 22:40:09 nativespace-cdp sshd[363859]: Received disconnect from 84.247.191.252 port 48496:11: Bye Bye [preauth]
Sep 10 22:40:09 nativespace-cdp sshd[363859]: Disconnected from 84.247.191.252 port 48496 [preauth]
Sep 10 22:40:13 nativespace-cdp sshd[363884]: Invalid user admin from 59.3.76.218 port 56622
Sep 10 22:40:13 nativespace-cdp sshd[363884]: input_userauth_request: invalid user admin [preauth]
Sep 10 22:40:13 nativespace-cdp sshd[363884]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:40:13 nativespace-cdp sshd[363884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.3.76.218
Sep 10 22:40:15 nativespace-cdp sshd[363884]: Failed password for invalid user admin from 59.3.76.218 port 56622 ssh2
Sep 10 22:40:19 nativespace-cdp sshd[363884]: Received disconnect from 59.3.76.218 port 56622:11: Bye Bye [preauth]
Sep 10 22:40:19 nativespace-cdp sshd[363884]: Disconnected from 59.3.76.218 port 56622 [preauth]
Sep 10 22:40:39 nativespace-cdp sshd[363958]: Invalid user oem from 206.217.133.9 port 39744
Sep 10 22:40:39 nativespace-cdp sshd[363958]: input_userauth_request: invalid user oem [preauth]
Sep 10 22:40:39 nativespace-cdp sshd[363958]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:40:39 nativespace-cdp sshd[363958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.217.133.9
Sep 10 22:40:42 nativespace-cdp sshd[363958]: Failed password for invalid user oem from 206.217.133.9 port 39744 ssh2
Sep 10 22:40:42 nativespace-cdp sshd[363958]: Received disconnect from 206.217.133.9 port 39744:11: Bye Bye [preauth]
Sep 10 22:40:42 nativespace-cdp sshd[363958]: Disconnected from 206.217.133.9 port 39744 [preauth]
Sep 10 22:40:49 nativespace-cdp sshd[364035]: Invalid user tp from 84.247.191.252 port 48528
Sep 10 22:40:49 nativespace-cdp sshd[364035]: input_userauth_request: invalid user tp [preauth]
Sep 10 22:40:49 nativespace-cdp sshd[364035]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:40:49 nativespace-cdp sshd[364035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.247.191.252
Sep 10 22:40:49 nativespace-cdp sshd[364032]: Invalid user tp from 195.26.47.38 port 43888
Sep 10 22:40:49 nativespace-cdp sshd[364032]: input_userauth_request: invalid user tp [preauth]
Sep 10 22:40:49 nativespace-cdp sshd[364032]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:40:49 nativespace-cdp sshd[364032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.26.47.38
Sep 10 22:40:51 nativespace-cdp sshd[364035]: Failed password for invalid user tp from 84.247.191.252 port 48528 ssh2
Sep 10 22:40:51 nativespace-cdp sshd[364035]: Received disconnect from 84.247.191.252 port 48528:11: Bye Bye [preauth]
Sep 10 22:40:51 nativespace-cdp sshd[364035]: Disconnected from 84.247.191.252 port 48528 [preauth]
Sep 10 22:40:51 nativespace-cdp sshd[364032]: Failed password for invalid user tp from 195.26.47.38 port 43888 ssh2
Sep 10 22:40:51 nativespace-cdp sshd[364032]: Received disconnect from 195.26.47.38 port 43888:11: Bye Bye [preauth]
Sep 10 22:40:51 nativespace-cdp sshd[364032]: Disconnected from 195.26.47.38 port 43888 [preauth]
Sep 10 22:41:02 nativespace-cdp sshd[364124]: Invalid user spooler from 59.3.76.218 port 41412
Sep 10 22:41:02 nativespace-cdp sshd[364124]: input_userauth_request: invalid user spooler [preauth]
Sep 10 22:41:02 nativespace-cdp sshd[364124]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:41:02 nativespace-cdp sshd[364124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.3.76.218
Sep 10 22:41:04 nativespace-cdp sshd[364124]: Failed password for invalid user spooler from 59.3.76.218 port 41412 ssh2
Sep 10 22:41:12 nativespace-cdp sshd[364180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.103.169.12  user=root
Sep 10 22:41:12 nativespace-cdp sshd[364180]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 22:41:14 nativespace-cdp sshd[364180]: Failed password for root from 186.103.169.12 port 55002 ssh2
Sep 10 22:41:14 nativespace-cdp sshd[364180]: Received disconnect from 186.103.169.12 port 55002:11: Bye Bye [preauth]
Sep 10 22:41:14 nativespace-cdp sshd[364180]: Disconnected from 186.103.169.12 port 55002 [preauth]
Sep 10 22:41:22 nativespace-cdp sshd[364411]: Invalid user spooler from 206.217.133.9 port 55074
Sep 10 22:41:22 nativespace-cdp sshd[364411]: input_userauth_request: invalid user spooler [preauth]
Sep 10 22:41:22 nativespace-cdp sshd[364411]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:41:22 nativespace-cdp sshd[364411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.217.133.9
Sep 10 22:41:23 nativespace-cdp sshd[364411]: Failed password for invalid user spooler from 206.217.133.9 port 55074 ssh2
Sep 10 22:41:23 nativespace-cdp sshd[364411]: Received disconnect from 206.217.133.9 port 55074:11: Bye Bye [preauth]
Sep 10 22:41:23 nativespace-cdp sshd[364411]: Disconnected from 206.217.133.9 port 55074 [preauth]
Sep 10 22:41:37 nativespace-cdp sshd[364750]: Connection closed by 159.100.136.21 port 42104 [preauth]
Sep 10 22:42:09 nativespace-cdp sshd[364837]: Invalid user snoopy from 186.103.169.12 port 37664
Sep 10 22:42:09 nativespace-cdp sshd[364837]: input_userauth_request: invalid user snoopy [preauth]
Sep 10 22:42:09 nativespace-cdp sshd[364837]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:42:09 nativespace-cdp sshd[364837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.103.169.12
Sep 10 22:42:11 nativespace-cdp sshd[364837]: Failed password for invalid user snoopy from 186.103.169.12 port 37664 ssh2
Sep 10 22:42:11 nativespace-cdp sshd[364837]: Received disconnect from 186.103.169.12 port 37664:11: Bye Bye [preauth]
Sep 10 22:42:11 nativespace-cdp sshd[364837]: Disconnected from 186.103.169.12 port 37664 [preauth]
Sep 10 22:46:30 nativespace-cdp sshd[365871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.92.107.125  user=root
Sep 10 22:46:30 nativespace-cdp sshd[365871]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 10 22:46:33 nativespace-cdp sshd[365881]: Connection closed by 159.100.136.21 port 51166 [preauth]
Sep 10 22:46:33 nativespace-cdp sshd[365871]: Failed password for root from 36.92.107.125 port 60964 ssh2
Sep 10 22:46:33 nativespace-cdp sshd[365871]: Received disconnect from 36.92.107.125 port 60964:11: Bye Bye [preauth]
Sep 10 22:46:33 nativespace-cdp sshd[365871]: Disconnected from 36.92.107.125 port 60964 [preauth]
Sep 10 22:47:49 nativespace-cdp sshd[366146]: Invalid user swuser from 36.92.107.125 port 52868
Sep 10 22:47:49 nativespace-cdp sshd[366146]: input_userauth_request: invalid user swuser [preauth]
Sep 10 22:47:49 nativespace-cdp sshd[366146]: pam_unix(sshd:auth): check pass; user unknown
Sep 10 22:47:49 nativespace-cdp sshd[366146]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.92.107.125
Sep 10 22:47:51 nativespace-cdp sshd[366146]: Failed password for invalid user swuser from 36.92.107.125 port 52868 ssh2
Sep 10 22:47:52 nativespace-cdp sshd[366146]: Received disconnect from 36.92.107.125 port 52868:11: Bye Bye [preauth]
Sep 10 22:47:52 nativespace-cdp sshd[366146]: Disconnected from 36.92.107.125 port 52868 [preauth]
Sep 10 22:51:33 nativespace-cdp sshd[367080]: Connection closed by 159.100.136.21 port 59968 [preauth]
Sep 10 22:56:33 nativespace-cdp sshd[368254]: Connection closed by 159.100.136.21 port 41336 [preauth]
Sep 10 23:01:39 nativespace-cdp sshd[369187]: Connection closed by 159.100.136.21 port 50850 [preauth]
Sep 10 23:06:34 nativespace-cdp sshd[370985]: Connection closed by 159.100.136.21 port 59734 [preauth]
Sep 10 23:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 10 23:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:29 nativespace-cdp sudo[371499]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 10 23:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:29 nativespace-cdp sudo[371503]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 10 23:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:31 nativespace-cdp sudo[371508]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 10 23:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:31 nativespace-cdp sudo[371520]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 10 23:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:35 nativespace-cdp sudo[371526]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 10 23:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:35 nativespace-cdp sudo[371545]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 10 23:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:35 nativespace-cdp sudo[371551]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 10 23:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:35 nativespace-cdp sudo[371555]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 10 23:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:35 nativespace-cdp sudo[371560]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 10 23:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:35 nativespace-cdp sudo[371566]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 10 23:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:35 nativespace-cdp sudo[371572]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 10 23:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:37 nativespace-cdp sudo[371582]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 10 23:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:38 nativespace-cdp sudo[371589]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=what user-2=oubpgvbx user-3=tstardom user-4=nvihkvu user-5=cath user-6=sketchy user-7=havantho user-8=kategilpin user-9=ladburyp user-10=stagingerris user-11=dancinggardener user-12=design user-13=nove user-14=boldover user-15=sosevalu user-16=crrtipdl user-17=bakery user-18=attlebor user-19=lucy user-20=onlycont user-21=branko user-22=outdoorc user-23=ranxterc user-24=hodgsonmail user-25=romaldki user-26=tomandle user-27=jennimil user-28=mcdermos user-29=chrisdal user-30=nbhavers user-31=careers user-32=david user-33=reliable user-34=ninejimm user-35=cambria1 user-36=cathski user-37=howardon user-38=pugwash user-39=paulmca1 user-40=cwsocial user-41=hirefootballgame user-42=courseme user-43=eugincou user-44=fortunaz user-45=health2045 user-46=foods user-47=leftie user-48=putterfc user-49=nscdp
Sep 10 23:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=philmcph user-51=ctedorgu user-52=donnychicago user-53=steakbridieme user-54=firstre5 user-55=lkpier user-56=smrszyqg user-57=isleofwi user-58=tigerlet user-59=barbersh user-60=hidden user-61=nomistakes user-62=burydropin user-63=fawcettd user-64=nsceres user-65=eatspam user-66=darkstar user-67=beauty user-68=dhyana user-69=sibtoncc user-70=asandcoc user-71=zebrapho user-72=bwppodcast user-73=steve user-74=alexadmin user-75=skyfirec user-76=stuartge user-77=askhform user-78=innovat1 user-79=nativene user-80=brighto1 user-81=nstriton user-82=battlere user-83=oneoarco user-84=firstre2 user-85=vivienn1 user-86=bedfords user-87=bemadonn user-88=ggaaorgu user-89=belle user-90=newstoda user-91=elecleis user-92=milloyco user-93=gilpin user-94=carsinyo user-95=fetch user-96=hubmaster user-97=putterfi user-98=ianrayne user-99=accooper user-100=thqkgnbz user-101=connectedshoppin user-102=firstres user-103=jonhartl
Sep 10 23:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=seftvta user-105=ultbcrra user-106=coursemc user-107=opaiscyx user-108=costestimatorco user-109=firstrel user-110=clarkass user-111=southlon user-112=highlegh user-113=firstred user-114=martsblo user-115=ptkxhsbt user-116=dickemery123 user-117=lbhyisi user-118=hhdugcor user-119=magichat user-120=lakesan1 user-121=brmrjxl user-122=sarafoundation user-123=atestord user-124=strathar user-125=wilsonsw user-126=musorguk user-127=megacards user-128=jarvisin user-129=hodgesonweb user-130=theblack user-131=spectrum user-132=still user-133=agproduc user-134=leereyn1 user-135=stephani user-136=markward user-137=booff user-138=foundation user-139=maflemin user-140=lbscrmod user-141=connect9 user-142=athenare user-143=vantagep user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains feature-9=webprotect
Sep 10 23:09:38 nativespace-cdp sudo: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 10 23:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:39 nativespace-cdp sudo[371595]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:39 nativespace-cdp sudo[371602]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-BGLoWwz1acCmdqGk.~
Sep 10 23:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:40 nativespace-cdp sudo[371608]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-BGLoWwz1acCmdqGk.~'
Sep 10 23:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:40 nativespace-cdp sudo[371612]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-BGLoWwz1acCmdqGk.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 10 23:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:40 nativespace-cdp sudo[371618]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 10 23:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:40 nativespace-cdp sudo[371623]: pam_unix(sudo:session): session closed for user root
Sep 10 23:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 10 23:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 10 23:09:58 nativespace-cdp sudo[371686]: pam_unix(sudo:session): session closed for user root
Sep 10 23:11:33 nativespace-cdp sshd[372348]: Connection closed by 159.100.136.21 port 40826 [preauth]
Sep 10 23:16:33 nativespace-cdp sshd[373728]: Connection closed by 159.100.136.21 port 50420 [preauth]
Sep 10 23:21:33 nativespace-cdp sshd[375142]: Connection closed by 159.100.136.21 port 59698 [preauth]
Sep 10 23:26:33 nativespace-cdp sshd[376494]: Connection closed by 159.100.136.21 port 41088 [preauth]
Sep 10 23:31:33 nativespace-cdp sshd[377854]: Connection closed by 159.100.136.21 port 50068 [preauth]
Sep 10 23:36:33 nativespace-cdp sshd[378912]: Connection closed by 159.100.136.21 port 59150 [preauth]
Sep 10 23:41:33 nativespace-cdp sshd[380209]: Connection closed by 159.100.136.21 port 40248 [preauth]
Sep 10 23:46:33 nativespace-cdp sshd[381548]: Connection closed by 159.100.136.21 port 49794 [preauth]
Sep 10 23:51:35 nativespace-cdp sshd[382614]: Connection closed by 159.100.136.21 port 58760 [preauth]
Sep 10 23:56:37 nativespace-cdp sshd[383880]: Connection closed by 159.100.136.21 port 40224 [preauth]
Sep 11 00:01:36 nativespace-cdp sshd[385462]: Connection closed by 159.100.136.21 port 49008 [preauth]
Sep 11 00:06:33 nativespace-cdp sshd[386617]: Connection closed by 159.100.136.21 port 57178 [preauth]
Sep 11 00:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 00:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:24 nativespace-cdp sudo[387085]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 00:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:25 nativespace-cdp sudo[387090]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 00:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:26 nativespace-cdp sudo[387095]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 00:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:26 nativespace-cdp sudo[387102]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 00:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:29 nativespace-cdp sudo[387108]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 00:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:30 nativespace-cdp sudo[387129]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 00:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:30 nativespace-cdp sudo[387134]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 00:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:30 nativespace-cdp sudo[387138]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 00:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:30 nativespace-cdp sudo[387143]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 00:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:30 nativespace-cdp sudo[387148]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 00:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:30 nativespace-cdp sudo[387154]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 00:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:32 nativespace-cdp sudo[387165]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 00:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:32 nativespace-cdp sudo[387172]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=mcdermos user-2=chrisdal user-3=david user-4=nbhavers user-5=careers user-6=tomandle user-7=jennimil user-8=branko user-9=hodgsonmail user-10=outdoorc user-11=ranxterc user-12=romaldki user-13=lucy user-14=attlebor user-15=onlycont user-16=crrtipdl user-17=sosevalu user-18=bakery user-19=nove user-20=boldover user-21=kategilpin user-22=stagingerris user-23=dancinggardener user-24=ladburyp user-25=design user-26=what user-27=oubpgvbx user-28=tstardom user-29=nvihkvu user-30=havantho user-31=sketchy user-32=cath user-33=zebrapho user-34=bwppodcast user-35=steve user-36=asandcoc user-37=sibtoncc user-38=darkstar user-39=eatspam user-40=beauty user-41=dhyana user-42=fawcettd user-43=burydropin user-44=nsceres user-45=smrszyqg user-46=isleofwi user-47=barbersh user-48=tigerlet user-49=nomistakes
Sep 11 00:09:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=hidden user-51=leftie user-52=foods user-53=fortunaz user-54=health2045 user-55=nscdp user-56=putterfc user-57=steakbridieme user-58=donnychicago user-59=firstre5 user-60=philmcph user-61=ctedorgu user-62=lkpier user-63=hirefootballgame user-64=courseme user-65=eugincou user-66=ninejimm user-67=reliable user-68=cambria1 user-69=cathski user-70=cwsocial user-71=pugwash user-72=howardon user-73=paulmca1 user-74=costestimatorco user-75=firstrel user-76=clarkass user-77=highlegh user-78=southlon user-79=firstred user-80=firstres user-81=ultbcrra user-82=jonhartl user-83=seftvta user-84=coursemc user-85=opaiscyx user-86=ianrayne user-87=accooper user-88=thqkgnbz user-89=connectedshoppin user-90=elecleis user-91=milloyco user-92=gilpin user-93=fetch user-94=carsinyo user-95=hubmaster user-96=putterfi user-97=bedfords user-98=bemadonn user-99=newstoda user-100=belle user-101=ggaaorgu user-102=nstriton
Sep 11 00:09:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=brighto1 user-104=oneoarco user-105=battlere user-106=vivienn1 user-107=firstre2 user-108=stuartge user-109=askhform user-110=innovat1 user-111=nativene user-112=skyfirec user-113=alexadmin user-114=ulsukarm user-115=booff user-116=markward user-117=foundation user-118=lbscrmod user-119=maflemin user-120=vantagep user-121=connect9 user-122=athenare user-123=agproduc user-124=still user-125=leereyn1 user-126=stephani user-127=jarvisin user-128=theblack user-129=hodgesonweb user-130=spectrum user-131=wilsonsw user-132=megacards user-133=musorguk user-134=brmrjxl user-135=lakesan1 user-136=atestord user-137=sarafoundation user-138=strathar user-139=hhdugcor user-140=lbhyisi user-141=magichat user-142=martsblo user-143=ptkxhsbt user-144=dickemery123 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 00:09:32 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 00:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:33 nativespace-cdp sudo[387181]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:34 nativespace-cdp sudo[387188]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jkIktsK9Y4T8kCMF.~
Sep 11 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:34 nativespace-cdp sudo[387193]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jkIktsK9Y4T8kCMF.~'
Sep 11 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:34 nativespace-cdp sudo[387197]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jkIktsK9Y4T8kCMF.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:34 nativespace-cdp sudo[387203]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:34 nativespace-cdp sudo[387208]: pam_unix(sudo:session): session closed for user root
Sep 11 00:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 00:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 00:09:36 nativespace-cdp sudo[387231]: pam_unix(sudo:session): session closed for user root
Sep 11 00:11:33 nativespace-cdp sshd[387796]: Connection closed by 159.100.136.21 port 38450 [preauth]
Sep 11 00:16:35 nativespace-cdp sshd[389242]: Connection closed by 159.100.136.21 port 47972 [preauth]
Sep 11 00:21:33 nativespace-cdp sshd[390237]: Connection closed by 159.100.136.21 port 57502 [preauth]
Sep 11 00:26:34 nativespace-cdp sshd[391288]: Connection closed by 159.100.136.21 port 38786 [preauth]
Sep 11 00:31:33 nativespace-cdp sshd[392439]: Connection closed by 159.100.136.21 port 48140 [preauth]
Sep 11 00:36:33 nativespace-cdp sshd[393507]: Connection closed by 159.100.136.21 port 57966 [preauth]
Sep 11 00:41:36 nativespace-cdp sshd[395162]: Connection closed by 159.100.136.21 port 38668 [preauth]
Sep 11 00:46:33 nativespace-cdp sshd[396432]: Connection closed by 159.100.136.21 port 48312 [preauth]
Sep 11 00:51:34 nativespace-cdp sshd[397503]: Connection closed by 159.100.136.21 port 57234 [preauth]
Sep 11 00:56:35 nativespace-cdp sshd[398551]: Connection closed by 159.100.136.21 port 38608 [preauth]
Sep 11 01:01:33 nativespace-cdp sshd[399781]: Connection closed by 159.100.136.21 port 47762 [preauth]
Sep 11 01:06:33 nativespace-cdp sshd[401083]: Connection closed by 159.100.136.21 port 56290 [preauth]
Sep 11 01:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 01:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:20 nativespace-cdp sudo[401772]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 01:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:20 nativespace-cdp sudo[401775]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 01:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:20 nativespace-cdp sudo[401778]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 01:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:20 nativespace-cdp sudo[401787]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 01:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:24 nativespace-cdp sudo[401790]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 01:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:24 nativespace-cdp sudo[401801]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 01:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:24 nativespace-cdp sudo[401805]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 01:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:24 nativespace-cdp sudo[401808]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 01:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:24 nativespace-cdp sudo[401811]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 01:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:24 nativespace-cdp sudo[401814]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 01:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:24 nativespace-cdp sudo[401817]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 01:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:26 nativespace-cdp sudo[401825]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 01:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:26 nativespace-cdp sudo[401829]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=highlegh user-2=southlon user-3=firstred user-4=costestimatorco user-5=clarkass user-6=firstrel user-7=coursemc user-8=opaiscyx user-9=firstres user-10=ultbcrra user-11=seftvta user-12=jonhartl user-13=thqkgnbz user-14=connectedshoppin user-15=ianrayne user-16=accooper user-17=fetch user-18=carsinyo user-19=hubmaster user-20=putterfi user-21=elecleis user-22=gilpin user-23=milloyco user-24=bemadonn user-25=newstoda user-26=belle user-27=ggaaorgu user-28=bedfords user-29=oneoarco user-30=battlere user-31=vivienn1 user-32=firstre2 user-33=nstriton user-34=brighto1 user-35=nativene user-36=stuartge user-37=askhform user-38=innovat1 user-39=alexadmin user-40=skyfirec user-41=ulsukarm user-42=lbscrmod user-43=maflemin user-44=vantagep user-45=connect9 user-46=athenare user-47=booff user-48=foundation
Sep 11 01:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=markward user-50=leereyn1 user-51=stephani user-52=agproduc user-53=still user-54=hodgesonweb user-55=theblack user-56=spectrum user-57=jarvisin user-58=megacards user-59=musorguk user-60=wilsonsw user-61=atestord user-62=sarafoundation user-63=strathar user-64=brmrjxl user-65=lakesan1 user-66=magichat user-67=hhdugcor user-68=lbhyisi user-69=ptkxhsbt user-70=dickemery123 user-71=martsblo user-72=david user-73=nbhavers user-74=careers user-75=mcdermos user-76=chrisdal user-77=jennimil user-78=tomandle user-79=romaldki user-80=branko user-81=hodgsonmail user-82=outdoorc user-83=ranxterc user-84=onlycont user-85=lucy user-86=attlebor user-87=crrtipdl user-88=sosevalu user-89=bakery user-90=boldover user-91=nove user-92=design user-93=kategilpin user-94=stagingerris user-95=dancinggardener user-96=ladburyp user-97=nvihkvu user-98=havantho user-99=cath user-100=sketchy user-101=what user-102=oubpgvbx
Sep 11 01:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=tstardom user-104=steve user-105=zebrapho user-106=bwppodcast user-107=asandcoc user-108=sibtoncc user-109=dhyana user-110=darkstar user-111=eatspam user-112=beauty user-113=nsceres user-114=fawcettd user-115=burydropin user-116=tigerlet user-117=barbersh user-118=nomistakes user-119=hidden user-120=smrszyqg user-121=isleofwi user-122=steakbridieme user-123=donnychicago user-124=firstre5 user-125=ctedorgu user-126=philmcph user-127=lkpier user-128=leftie user-129=foods user-130=fortunaz user-131=health2045 user-132=nscdp user-133=putterfc user-134=courseme user-135=eugincou user-136=hirefootballgame user-137=cwsocial user-138=pugwash user-139=howardon user-140=paulmca1 user-141=reliable user-142=ninejimm user-143=cathski user-144=cambria1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 01:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 01:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:27 nativespace-cdp sudo[401834]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 01:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:27 nativespace-cdp sudo[401838]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DR1XPUWvYYaBipl4.~
Sep 11 01:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:27 nativespace-cdp sudo[401841]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DR1XPUWvYYaBipl4.~'
Sep 11 01:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:27 nativespace-cdp sudo[401845]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DR1XPUWvYYaBipl4.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 01:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:27 nativespace-cdp sudo[401849]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 01:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:27 nativespace-cdp sudo[401852]: pam_unix(sudo:session): session closed for user root
Sep 11 01:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 01:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 01:09:44 nativespace-cdp sudo[401916]: pam_unix(sudo:session): session closed for user root
Sep 11 01:11:34 nativespace-cdp sshd[402813]: Connection closed by 159.100.136.21 port 36326 [preauth]
Sep 11 01:16:33 nativespace-cdp sshd[403814]: Connection closed by 159.100.136.21 port 45870 [preauth]
Sep 11 01:21:33 nativespace-cdp sshd[404881]: Connection closed by 159.100.136.21 port 55076 [preauth]
Sep 11 01:26:33 nativespace-cdp sshd[405905]: Connection closed by 159.100.136.21 port 35920 [preauth]
Sep 11 01:31:34 nativespace-cdp sshd[407341]: Connection closed by 159.100.136.21 port 45104 [preauth]
Sep 11 01:36:35 nativespace-cdp sshd[408343]: Connection closed by 159.100.136.21 port 54094 [preauth]
Sep 11 01:41:27 nativespace-cdp sshd[409416]: Invalid user factory from 159.223.82.57 port 37942
Sep 11 01:41:27 nativespace-cdp sshd[409416]: input_userauth_request: invalid user factory [preauth]
Sep 11 01:41:27 nativespace-cdp sshd[409416]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 01:41:27 nativespace-cdp sshd[409416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.82.57
Sep 11 01:41:29 nativespace-cdp sshd[409416]: Failed password for invalid user factory from 159.223.82.57 port 37942 ssh2
Sep 11 01:41:33 nativespace-cdp sshd[409416]: Received disconnect from 159.223.82.57 port 37942:11: Bye Bye [preauth]
Sep 11 01:41:33 nativespace-cdp sshd[409416]: Disconnected from 159.223.82.57 port 37942 [preauth]
Sep 11 01:41:34 nativespace-cdp sshd[409468]: Connection closed by 159.100.136.21 port 35370 [preauth]
Sep 11 01:45:40 nativespace-cdp sshd[410792]: Invalid user as from 159.223.82.57 port 34294
Sep 11 01:45:40 nativespace-cdp sshd[410792]: input_userauth_request: invalid user as [preauth]
Sep 11 01:45:40 nativespace-cdp sshd[410792]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 01:45:40 nativespace-cdp sshd[410792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.82.57
Sep 11 01:45:42 nativespace-cdp sshd[410792]: Failed password for invalid user as from 159.223.82.57 port 34294 ssh2
Sep 11 01:45:42 nativespace-cdp sshd[410792]: Received disconnect from 159.223.82.57 port 34294:11: Bye Bye [preauth]
Sep 11 01:45:42 nativespace-cdp sshd[410792]: Disconnected from 159.223.82.57 port 34294 [preauth]
Sep 11 01:46:28 nativespace-cdp sshd[411029]: Invalid user user from 159.223.82.57 port 48530
Sep 11 01:46:28 nativespace-cdp sshd[411029]: input_userauth_request: invalid user user [preauth]
Sep 11 01:46:28 nativespace-cdp sshd[411029]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 01:46:28 nativespace-cdp sshd[411029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.82.57
Sep 11 01:46:29 nativespace-cdp sshd[411029]: Failed password for invalid user user from 159.223.82.57 port 48530 ssh2
Sep 11 01:46:37 nativespace-cdp sshd[411067]: Connection closed by 159.100.136.21 port 44824 [preauth]
Sep 11 01:51:35 nativespace-cdp sshd[412680]: Connection closed by 159.100.136.21 port 54274 [preauth]
Sep 11 01:56:33 nativespace-cdp sshd[415044]: Connection closed by 159.100.136.21 port 35580 [preauth]
Sep 11 01:56:44 nativespace-cdp sshd[415070]: Invalid user postmaster from 122.49.220.102 port 44016
Sep 11 01:56:44 nativespace-cdp sshd[415070]: input_userauth_request: invalid user postmaster [preauth]
Sep 11 01:56:44 nativespace-cdp sshd[415070]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 01:56:44 nativespace-cdp sshd[415070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.49.220.102
Sep 11 01:56:46 nativespace-cdp sshd[415070]: Failed password for invalid user postmaster from 122.49.220.102 port 44016 ssh2
Sep 11 01:56:48 nativespace-cdp sshd[415070]: Received disconnect from 122.49.220.102 port 44016:11: Bye Bye [preauth]
Sep 11 01:56:48 nativespace-cdp sshd[415070]: Disconnected from 122.49.220.102 port 44016 [preauth]
Sep 11 01:57:08 nativespace-cdp sshd[415148]: Invalid user asdf from 39.109.104.153 port 60224
Sep 11 01:57:08 nativespace-cdp sshd[415148]: input_userauth_request: invalid user asdf [preauth]
Sep 11 01:57:08 nativespace-cdp sshd[415148]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 01:57:08 nativespace-cdp sshd[415148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.109.104.153
Sep 11 01:57:09 nativespace-cdp sshd[415148]: Failed password for invalid user asdf from 39.109.104.153 port 60224 ssh2
Sep 11 01:57:10 nativespace-cdp sshd[415148]: Received disconnect from 39.109.104.153 port 60224:11: Bye Bye [preauth]
Sep 11 01:57:10 nativespace-cdp sshd[415148]: Disconnected from 39.109.104.153 port 60224 [preauth]
Sep 11 01:57:16 nativespace-cdp sshd[415156]: Invalid user tesla from 107.173.149.47 port 51828
Sep 11 01:57:16 nativespace-cdp sshd[415156]: input_userauth_request: invalid user tesla [preauth]
Sep 11 01:57:16 nativespace-cdp sshd[415156]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 01:57:16 nativespace-cdp sshd[415156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.173.149.47
Sep 11 01:57:18 nativespace-cdp sshd[415156]: Failed password for invalid user tesla from 107.173.149.47 port 51828 ssh2
Sep 11 01:57:19 nativespace-cdp sshd[415156]: Received disconnect from 107.173.149.47 port 51828:11: Bye Bye [preauth]
Sep 11 01:57:19 nativespace-cdp sshd[415156]: Disconnected from 107.173.149.47 port 51828 [preauth]
Sep 11 02:01:33 nativespace-cdp sshd[416149]: Connection closed by 159.100.136.21 port 44752 [preauth]
Sep 11 02:03:02 nativespace-cdp sshd[416486]: Invalid user kramar from 64.227.174.243 port 37994
Sep 11 02:03:02 nativespace-cdp sshd[416486]: input_userauth_request: invalid user kramar [preauth]
Sep 11 02:03:02 nativespace-cdp sshd[416486]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 02:03:02 nativespace-cdp sshd[416486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.174.243
Sep 11 02:03:04 nativespace-cdp sshd[416486]: Failed password for invalid user kramar from 64.227.174.243 port 37994 ssh2
Sep 11 02:03:04 nativespace-cdp sshd[416486]: Received disconnect from 64.227.174.243 port 37994:11: Bye Bye [preauth]
Sep 11 02:03:04 nativespace-cdp sshd[416486]: Disconnected from 64.227.174.243 port 37994 [preauth]
Sep 11 02:04:25 nativespace-cdp sshd[416695]: Invalid user supervisor from 122.49.220.102 port 48262
Sep 11 02:04:25 nativespace-cdp sshd[416695]: input_userauth_request: invalid user supervisor [preauth]
Sep 11 02:04:25 nativespace-cdp sshd[416695]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 02:04:25 nativespace-cdp sshd[416695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.49.220.102
Sep 11 02:04:28 nativespace-cdp sshd[416695]: Failed password for invalid user supervisor from 122.49.220.102 port 48262 ssh2
Sep 11 02:04:28 nativespace-cdp sshd[416695]: Received disconnect from 122.49.220.102 port 48262:11: Bye Bye [preauth]
Sep 11 02:04:28 nativespace-cdp sshd[416695]: Disconnected from 122.49.220.102 port 48262 [preauth]
Sep 11 02:04:49 nativespace-cdp sshd[416754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.109.104.153  user=root
Sep 11 02:04:49 nativespace-cdp sshd[416754]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 02:04:52 nativespace-cdp sshd[416754]: Failed password for root from 39.109.104.153 port 59834 ssh2
Sep 11 02:04:52 nativespace-cdp sshd[416754]: Received disconnect from 39.109.104.153 port 59834:11: Bye Bye [preauth]
Sep 11 02:04:52 nativespace-cdp sshd[416754]: Disconnected from 39.109.104.153 port 59834 [preauth]
Sep 11 02:05:10 nativespace-cdp sshd[416889]: Invalid user qiyuesuo from 107.173.149.47 port 52638
Sep 11 02:05:10 nativespace-cdp sshd[416889]: input_userauth_request: invalid user qiyuesuo [preauth]
Sep 11 02:05:10 nativespace-cdp sshd[416889]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 02:05:10 nativespace-cdp sshd[416889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.173.149.47
Sep 11 02:05:11 nativespace-cdp sshd[416889]: Failed password for invalid user qiyuesuo from 107.173.149.47 port 52638 ssh2
Sep 11 02:05:12 nativespace-cdp sshd[416889]: Received disconnect from 107.173.149.47 port 52638:11: Bye Bye [preauth]
Sep 11 02:05:12 nativespace-cdp sshd[416889]: Disconnected from 107.173.149.47 port 52638 [preauth]
Sep 11 02:05:15 nativespace-cdp sshd[416932]: Invalid user fin from 122.49.220.102 port 49984
Sep 11 02:05:15 nativespace-cdp sshd[416932]: input_userauth_request: invalid user fin [preauth]
Sep 11 02:05:15 nativespace-cdp sshd[416932]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 02:05:15 nativespace-cdp sshd[416932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.49.220.102
Sep 11 02:05:17 nativespace-cdp sshd[416932]: Failed password for invalid user fin from 122.49.220.102 port 49984 ssh2
Sep 11 02:05:25 nativespace-cdp sshd[416932]: Received disconnect from 122.49.220.102 port 49984:11: Bye Bye [preauth]
Sep 11 02:05:25 nativespace-cdp sshd[416932]: Disconnected from 122.49.220.102 port 49984 [preauth]
Sep 11 02:05:43 nativespace-cdp sshd[417072]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.174.243  user=root
Sep 11 02:05:43 nativespace-cdp sshd[417072]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 02:05:44 nativespace-cdp sshd[417079]: Invalid user ubuntu from 107.173.149.47 port 37594
Sep 11 02:05:44 nativespace-cdp sshd[417079]: input_userauth_request: invalid user ubuntu [preauth]
Sep 11 02:05:44 nativespace-cdp sshd[417079]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 02:05:44 nativespace-cdp sshd[417079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.173.149.47
Sep 11 02:05:44 nativespace-cdp sshd[417076]: Invalid user fin from 39.109.104.153 port 44996
Sep 11 02:05:44 nativespace-cdp sshd[417076]: input_userauth_request: invalid user fin [preauth]
Sep 11 02:05:44 nativespace-cdp sshd[417076]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 02:05:44 nativespace-cdp sshd[417076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.109.104.153
Sep 11 02:05:45 nativespace-cdp sshd[417072]: Failed password for root from 64.227.174.243 port 47554 ssh2
Sep 11 02:05:45 nativespace-cdp sshd[417079]: Failed password for invalid user ubuntu from 107.173.149.47 port 37594 ssh2
Sep 11 02:05:45 nativespace-cdp sshd[417076]: Failed password for invalid user fin from 39.109.104.153 port 44996 ssh2
Sep 11 02:05:45 nativespace-cdp sshd[417072]: Received disconnect from 64.227.174.243 port 47554:11: Bye Bye [preauth]
Sep 11 02:05:45 nativespace-cdp sshd[417072]: Disconnected from 64.227.174.243 port 47554 [preauth]
Sep 11 02:05:45 nativespace-cdp sshd[417079]: Received disconnect from 107.173.149.47 port 37594:11: Bye Bye [preauth]
Sep 11 02:05:45 nativespace-cdp sshd[417079]: Disconnected from 107.173.149.47 port 37594 [preauth]
Sep 11 02:05:45 nativespace-cdp sshd[417076]: Received disconnect from 39.109.104.153 port 44996:11: Bye Bye [preauth]
Sep 11 02:05:45 nativespace-cdp sshd[417076]: Disconnected from 39.109.104.153 port 44996 [preauth]
Sep 11 02:06:33 nativespace-cdp sshd[417280]: Invalid user mqm from 64.227.174.243 port 52512
Sep 11 02:06:33 nativespace-cdp sshd[417280]: input_userauth_request: invalid user mqm [preauth]
Sep 11 02:06:33 nativespace-cdp sshd[417280]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 02:06:33 nativespace-cdp sshd[417280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.174.243
Sep 11 02:06:33 nativespace-cdp sshd[417283]: Connection closed by 159.100.136.21 port 54072 [preauth]
Sep 11 02:06:34 nativespace-cdp sshd[417280]: Failed password for invalid user mqm from 64.227.174.243 port 52512 ssh2
Sep 11 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:19 nativespace-cdp sudo[417834]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:19 nativespace-cdp sudo[417837]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:20 nativespace-cdp sudo[417840]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 02:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:20 nativespace-cdp sudo[417846]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 02:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:21 nativespace-cdp sudo[417849]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:21 nativespace-cdp sudo[417859]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:21 nativespace-cdp sudo[417862]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:21 nativespace-cdp sudo[417865]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:21 nativespace-cdp sudo[417869]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:21 nativespace-cdp sudo[417872]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 02:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:21 nativespace-cdp sudo[417875]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 02:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:28 nativespace-cdp sudo[417899]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 02:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:28 nativespace-cdp sudo[417903]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=coursemc user-2=opaiscyx user-3=ultbcrra user-4=jonhartl user-5=seftvta user-6=firstres user-7=firstred user-8=highlegh user-9=southlon user-10=clarkass user-11=firstrel user-12=costestimatorco user-13=hubmaster user-14=putterfi user-15=fetch user-16=carsinyo user-17=milloyco user-18=gilpin user-19=elecleis user-20=connectedshoppin user-21=thqkgnbz user-22=accooper user-23=ianrayne user-24=vivienn1 user-25=firstre2 user-26=oneoarco user-27=battlere user-28=nstriton user-29=brighto1 user-30=newstoda user-31=ggaaorgu user-32=belle user-33=bemadonn user-34=bedfords user-35=alexadmin user-36=skyfirec user-37=nativene user-38=innovat1 user-39=stuartge user-40=askhform user-41=vantagep user-42=athenare user-43=connect9 user-44=lbscrmod user-45=maflemin user-46=booff user-47=foundation user-48=markward
Sep 11 02:09:29 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=spectrum user-51=hodgesonweb user-52=theblack user-53=jarvisin user-54=stephani user-55=leereyn1 user-56=agproduc user-57=still user-58=strathar user-59=atestord user-60=sarafoundation user-61=lakesan1 user-62=brmrjxl user-63=megacards user-64=musorguk user-65=wilsonsw user-66=dickemery123 user-67=ptkxhsbt user-68=martsblo user-69=magichat user-70=hhdugcor user-71=lbhyisi user-72=jennimil user-73=tomandle user-74=david user-75=careers user-76=nbhavers user-77=chrisdal user-78=mcdermos user-79=onlycont user-80=lucy user-81=attlebor user-82=romaldki user-83=hodgsonmail user-84=outdoorc user-85=ranxterc user-86=branko user-87=boldover user-88=nove user-89=bakery user-90=crrtipdl user-91=sosevalu user-92=havantho user-93=cath user-94=sketchy user-95=nvihkvu user-96=oubpgvbx user-97=tstardom user-98=what user-99=design user-100=dancinggardener user-101=stagingerris user-102=ladburyp
Sep 11 02:09:29 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=kategilpin user-104=asandcoc user-105=sibtoncc user-106=steve user-107=bwppodcast user-108=zebrapho user-109=nsceres user-110=fawcettd user-111=burydropin user-112=dhyana user-113=beauty user-114=darkstar user-115=eatspam user-116=lkpier user-117=donnychicago user-118=steakbridieme user-119=firstre5 user-120=ctedorgu user-121=philmcph user-122=nscdp user-123=putterfc user-124=foods user-125=leftie user-126=fortunaz user-127=health2045 user-128=nomistakes user-129=hidden user-130=barbersh user-131=tigerlet user-132=smrszyqg user-133=isleofwi user-134=cwsocial user-135=pugwash user-136=howardon user-137=paulmca1 user-138=cambria1 user-139=cathski user-140=reliable user-141=ninejimm user-142=eugincou user-143=courseme user-144=hirefootballgame feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 02:09:29 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 02:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:29 nativespace-cdp sudo[417907]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 02:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:29 nativespace-cdp sudo[417912]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-m2ZGDTxkcXlAjEFw.~
Sep 11 02:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:29 nativespace-cdp sudo[417915]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-m2ZGDTxkcXlAjEFw.~'
Sep 11 02:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:29 nativespace-cdp sudo[417920]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-m2ZGDTxkcXlAjEFw.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 02:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:29 nativespace-cdp sudo[417924]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 02:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:29 nativespace-cdp sudo[417928]: pam_unix(sudo:session): session closed for user root
Sep 11 02:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 02:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:09:31 nativespace-cdp sudo[417946]: pam_unix(sudo:session): session closed for user root
Sep 11 02:11:33 nativespace-cdp sshd[418585]: Connection closed by 159.100.136.21 port 33682 [preauth]
Sep 11 02:16:36 nativespace-cdp sshd[419839]: Connection closed by 159.100.136.21 port 43552 [preauth]
Sep 11 02:21:35 nativespace-cdp sshd[424459]: Connection closed by 159.100.136.21 port 51926 [preauth]
Sep 11 02:26:34 nativespace-cdp sshd[426735]: Connection closed by 159.100.136.21 port 33150 [preauth]
Sep 11 02:31:33 nativespace-cdp sshd[427833]: Connection closed by 159.100.136.21 port 41774 [preauth]
Sep 11 02:36:35 nativespace-cdp sshd[429209]: Connection closed by 159.100.136.21 port 49848 [preauth]
Sep 11 02:41:33 nativespace-cdp sshd[430190]: Connection closed by 159.100.136.21 port 57398 [preauth]
Sep 11 02:46:33 nativespace-cdp sshd[431683]: Connection closed by 159.100.136.21 port 38738 [preauth]
Sep 11 02:51:35 nativespace-cdp sshd[432683]: Connection closed by 159.100.136.21 port 47992 [preauth]
Sep 11 02:53:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 02:53:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 02:53:02 nativespace-cdp sudo[433017]: pam_unix(sudo:session): session closed for user root
Sep 11 02:56:33 nativespace-cdp sshd[433830]: Connection closed by 159.100.136.21 port 56454 [preauth]
Sep 11 03:01:34 nativespace-cdp sshd[435116]: Connection closed by 159.100.136.21 port 37576 [preauth]
Sep 11 03:06:34 nativespace-cdp sshd[436248]: Connection closed by 159.100.136.21 port 47214 [preauth]
Sep 11 03:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 03:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:09:51 nativespace-cdp sudo[436874]: pam_unix(sudo:session): session closed for user root
Sep 11 03:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 03:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:09:51 nativespace-cdp sudo[436877]: pam_unix(sudo:session): session closed for user root
Sep 11 03:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 03:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:09:58 nativespace-cdp sudo[436880]: pam_unix(sudo:session): session closed for user root
Sep 11 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:09:58 nativespace-cdp sudo[436897]: pam_unix(sudo:session): session closed for user root
Sep 11 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:08 nativespace-cdp sudo[436900]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 03:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:08 nativespace-cdp sudo[437046]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 03:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:08 nativespace-cdp sudo[437049]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 03:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:08 nativespace-cdp sudo[437052]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 03:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:08 nativespace-cdp sudo[437055]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 03:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:08 nativespace-cdp sudo[437058]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 03:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:09 nativespace-cdp sudo[437061]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 03:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:18 nativespace-cdp sudo[437105]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 03:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:20 nativespace-cdp sudo[437109]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=sarafoundation user-2=atestord user-3=strathar user-4=brmrjxl user-5=lakesan1 user-6=musorguk user-7=megacards user-8=wilsonsw user-9=ptkxhsbt user-10=dickemery123 user-11=martsblo user-12=magichat user-13=lbhyisi user-14=hhdugcor user-15=maflemin user-16=lbscrmod user-17=athenare user-18=connect9 user-19=vantagep user-20=booff user-21=foundation user-22=markward user-23=ulsukarm user-24=theblack user-25=hodgesonweb user-26=spectrum user-27=jarvisin user-28=leereyn1 user-29=stephani user-30=still user-31=agproduc user-32=battlere user-33=oneoarco user-34=firstre2 user-35=vivienn1 user-36=brighto1 user-37=nstriton user-38=bemadonn user-39=ggaaorgu user-40=belle user-41=newstoda user-42=bedfords user-43=skyfirec user-44=alexadmin user-45=nativene user-46=stuartge user-47=askhform user-48=innovat1
Sep 11 03:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=coursemc user-50=opaiscyx user-51=firstres user-52=seftvta user-53=jonhartl user-54=ultbcrra user-55=southlon user-56=highlegh user-57=firstred user-58=costestimatorco user-59=firstrel user-60=clarkass user-61=carsinyo user-62=fetch user-63=putterfi user-64=hubmaster user-65=elecleis user-66=gilpin user-67=milloyco user-68=thqkgnbz user-69=connectedshoppin user-70=ianrayne user-71=accooper user-72=philmcph user-73=ctedorgu user-74=donnychicago user-75=steakbridieme user-76=firstre5 user-77=lkpier user-78=fortunaz user-79=health2045 user-80=leftie user-81=foods user-82=putterfc user-83=nscdp user-84=barbersh user-85=tigerlet user-86=hidden user-87=nomistakes user-88=smrszyqg user-89=isleofwi user-90=howardon user-91=pugwash user-92=paulmca1 user-93=cwsocial user-94=reliable user-95=ninejimm user-96=cambria1 user-97=cathski user-98=courseme user-99=eugincou user-100=hirefootballgame user-101=asandcoc
Sep 11 03:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sibtoncc user-103=steve user-104=zebrapho user-105=bwppodcast user-106=nsceres user-107=burydropin user-108=fawcettd user-109=dhyana user-110=eatspam user-111=darkstar user-112=beauty user-113=boldover user-114=nove user-115=sosevalu user-116=crrtipdl user-117=bakery user-118=nvihkvu user-119=cath user-120=sketchy user-121=havantho user-122=what user-123=tstardom user-124=oubpgvbx user-125=design user-126=kategilpin user-127=ladburyp user-128=dancinggardener user-129=stagingerris user-130=jennimil user-131=tomandle user-132=nbhavers user-133=careers user-134=david user-135=mcdermos user-136=chrisdal user-137=onlycont user-138=attlebor user-139=lucy user-140=romaldki user-141=branko user-142=outdoorc user-143=ranxterc user-144=hodgsonmail feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 03:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 03:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:22 nativespace-cdp sudo[437116]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 03:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:23 nativespace-cdp sudo[437126]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4TW3jYIyAnRkaxhI.~
Sep 11 03:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:23 nativespace-cdp sudo[437129]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4TW3jYIyAnRkaxhI.~'
Sep 11 03:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:23 nativespace-cdp sudo[437132]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4TW3jYIyAnRkaxhI.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 03:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:23 nativespace-cdp sudo[437136]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 03:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:23 nativespace-cdp sudo[437139]: pam_unix(sudo:session): session closed for user root
Sep 11 03:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 03:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 03:10:48 nativespace-cdp sudo[437210]: pam_unix(sudo:session): session closed for user root
Sep 11 03:11:33 nativespace-cdp sshd[437515]: Connection closed by 159.100.136.21 port 56048 [preauth]
Sep 11 03:16:33 nativespace-cdp sshd[438872]: Connection closed by 159.100.136.21 port 36968 [preauth]
Sep 11 03:21:33 nativespace-cdp sshd[439882]: Connection closed by 159.100.136.21 port 45906 [preauth]
Sep 11 03:26:33 nativespace-cdp sshd[440833]: Connection closed by 159.100.136.21 port 55390 [preauth]
Sep 11 03:31:36 nativespace-cdp sshd[442291]: Connection closed by 159.100.136.21 port 36544 [preauth]
Sep 11 03:36:33 nativespace-cdp sshd[443425]: Connection closed by 159.100.136.21 port 45170 [preauth]
Sep 11 03:41:34 nativespace-cdp sshd[444844]: Connection closed by 159.100.136.21 port 54686 [preauth]
Sep 11 03:46:33 nativespace-cdp sshd[446139]: Connection closed by 159.100.136.21 port 34594 [preauth]
Sep 11 03:51:34 nativespace-cdp sshd[447212]: Connection closed by 159.100.136.21 port 42642 [preauth]
Sep 11 03:56:34 nativespace-cdp sshd[448324]: Connection closed by 159.100.136.21 port 52092 [preauth]
Sep 11 04:01:35 nativespace-cdp sshd[449579]: Connection closed by 159.100.136.21 port 33228 [preauth]
Sep 11 04:06:33 nativespace-cdp sshd[450891]: Connection closed by 159.100.136.21 port 42234 [preauth]
Sep 11 04:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 04:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:23 nativespace-cdp sudo[451549]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 04:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:23 nativespace-cdp sudo[451553]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 04:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:23 nativespace-cdp sudo[451556]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 04:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:23 nativespace-cdp sudo[451562]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 04:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:27 nativespace-cdp sudo[451565]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 04:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:28 nativespace-cdp sudo[451592]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 04:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:28 nativespace-cdp sudo[451595]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 04:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:28 nativespace-cdp sudo[451598]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 04:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:28 nativespace-cdp sudo[451602]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 04:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:28 nativespace-cdp sudo[451605]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 04:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:28 nativespace-cdp sudo[451608]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 04:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:36 nativespace-cdp sudo[451676]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 04:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:36 nativespace-cdp sudo[451687]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=coursemc user-2=opaiscyx user-3=firstres user-4=ultbcrra user-5=jonhartl user-6=seftvta user-7=highlegh user-8=southlon user-9=firstred user-10=costestimatorco user-11=firstrel user-12=clarkass user-13=fetch user-14=carsinyo user-15=putterfi user-16=hubmaster user-17=elecleis user-18=milloyco user-19=gilpin user-20=thqkgnbz user-21=connectedshoppin user-22=ianrayne user-23=accooper user-24=oneoarco user-25=battlere user-26=vivienn1 user-27=firstre2 user-28=nstriton user-29=brighto1 user-30=bemadonn user-31=newstoda user-32=belle user-33=ggaaorgu user-34=bedfords user-35=skyfirec user-36=alexadmin user-37=nativene user-38=stuartge user-39=askhform user-40=innovat1 user-41=lbscrmod user-42=maflemin user-43=vantagep user-44=athenare user-45=connect9 user-46=markward user-47=booff user-48=foundation
Sep 11 04:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=hodgesonweb user-51=theblack user-52=spectrum user-53=jarvisin user-54=leereyn1 user-55=stephani user-56=agproduc user-57=still user-58=atestord user-59=sarafoundation user-60=strathar user-61=lakesan1 user-62=brmrjxl user-63=megacards user-64=musorguk user-65=wilsonsw user-66=ptkxhsbt user-67=dickemery123 user-68=martsblo user-69=magichat user-70=hhdugcor user-71=lbhyisi user-72=jennimil user-73=tomandle user-74=david user-75=careers user-76=nbhavers user-77=mcdermos user-78=chrisdal user-79=onlycont user-80=lucy user-81=attlebor user-82=romaldki user-83=branko user-84=ranxterc user-85=hodgsonmail user-86=outdoorc user-87=boldover user-88=nove user-89=crrtipdl user-90=sosevalu user-91=bakery user-92=nvihkvu user-93=havantho user-94=cath user-95=sketchy user-96=what user-97=tstardom user-98=oubpgvbx user-99=design user-100=kategilpin user-101=dancinggardener user-102=stagingerris
Sep 11 04:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ladburyp user-104=asandcoc user-105=sibtoncc user-106=steve user-107=zebrapho user-108=bwppodcast user-109=nsceres user-110=fawcettd user-111=burydropin user-112=dhyana user-113=darkstar user-114=eatspam user-115=beauty user-116=steakbridieme user-117=donnychicago user-118=firstre5 user-119=ctedorgu user-120=philmcph user-121=lkpier user-122=foods user-123=leftie user-124=fortunaz user-125=health2045 user-126=nscdp user-127=putterfc user-128=tigerlet user-129=barbersh user-130=nomistakes user-131=hidden user-132=smrszyqg user-133=isleofwi user-134=cwsocial user-135=pugwash user-136=howardon user-137=paulmca1 user-138=reliable user-139=ninejimm user-140=cambria1 user-141=cathski user-142=courseme user-143=eugincou user-144=hirefootballgame feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 04:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 04:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:37 nativespace-cdp sudo[451717]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:38 nativespace-cdp sudo[451855]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Nu6DSh5QT7mIdgGb.~
Sep 11 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:38 nativespace-cdp sudo[451864]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Nu6DSh5QT7mIdgGb.~'
Sep 11 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:38 nativespace-cdp sudo[451867]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Nu6DSh5QT7mIdgGb.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:38 nativespace-cdp sudo[451871]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:38 nativespace-cdp sudo[451874]: pam_unix(sudo:session): session closed for user root
Sep 11 04:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 04:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:09:40 nativespace-cdp sudo[451921]: pam_unix(sudo:session): session closed for user root
Sep 11 04:11:33 nativespace-cdp sshd[452766]: Connection closed by 159.100.136.21 port 51472 [preauth]
Sep 11 04:16:33 nativespace-cdp sshd[454031]: Connection closed by 159.100.136.21 port 32928 [preauth]
Sep 11 04:21:36 nativespace-cdp sshd[455271]: Connection closed by 159.100.136.21 port 40764 [preauth]
Sep 11 04:26:37 nativespace-cdp sshd[457118]: Connection closed by 159.100.136.21 port 50536 [preauth]
Sep 11 04:31:35 nativespace-cdp sshd[459019]: Connection closed by 159.100.136.21 port 58752 [preauth]
Sep 11 04:36:33 nativespace-cdp sshd[461010]: Connection closed by 159.100.136.21 port 39790 [preauth]
Sep 11 04:41:05 nativespace-cdp sshd[462460]: Invalid user admin from 198.12.86.4 port 41310
Sep 11 04:41:05 nativespace-cdp sshd[462460]: input_userauth_request: invalid user admin [preauth]
Sep 11 04:41:05 nativespace-cdp sshd[462460]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:41:05 nativespace-cdp sshd[462460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.86.4
Sep 11 04:41:07 nativespace-cdp sshd[462460]: Failed password for invalid user admin from 198.12.86.4 port 41310 ssh2
Sep 11 04:41:07 nativespace-cdp sshd[462460]: Received disconnect from 198.12.86.4 port 41310:11: Bye Bye [preauth]
Sep 11 04:41:07 nativespace-cdp sshd[462460]: Disconnected from 198.12.86.4 port 41310 [preauth]
Sep 11 04:41:27 nativespace-cdp sshd[462543]: Invalid user ugo from 51.77.245.237 port 52964
Sep 11 04:41:27 nativespace-cdp sshd[462543]: input_userauth_request: invalid user ugo [preauth]
Sep 11 04:41:27 nativespace-cdp sshd[462543]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:41:27 nativespace-cdp sshd[462543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.245.237
Sep 11 04:41:30 nativespace-cdp sshd[462543]: Failed password for invalid user ugo from 51.77.245.237 port 52964 ssh2
Sep 11 04:41:30 nativespace-cdp sshd[462543]: Received disconnect from 51.77.245.237 port 52964:11: Bye Bye [preauth]
Sep 11 04:41:30 nativespace-cdp sshd[462543]: Disconnected from 51.77.245.237 port 52964 [preauth]
Sep 11 04:41:33 nativespace-cdp sshd[462565]: Connection closed by 159.100.136.21 port 48158 [preauth]
Sep 11 04:41:49 nativespace-cdp sshd[462599]: Invalid user roberto from 154.92.16.119 port 39830
Sep 11 04:41:49 nativespace-cdp sshd[462599]: input_userauth_request: invalid user roberto [preauth]
Sep 11 04:41:49 nativespace-cdp sshd[462599]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:41:49 nativespace-cdp sshd[462599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.92.16.119
Sep 11 04:41:52 nativespace-cdp sshd[462599]: Failed password for invalid user roberto from 154.92.16.119 port 39830 ssh2
Sep 11 04:41:52 nativespace-cdp sshd[462599]: Received disconnect from 154.92.16.119 port 39830:11: Bye Bye [preauth]
Sep 11 04:41:52 nativespace-cdp sshd[462599]: Disconnected from 154.92.16.119 port 39830 [preauth]
Sep 11 04:42:35 nativespace-cdp sshd[462736]: Invalid user maman from 157.92.113.49 port 57987
Sep 11 04:42:35 nativespace-cdp sshd[462736]: input_userauth_request: invalid user maman [preauth]
Sep 11 04:42:35 nativespace-cdp sshd[462736]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:42:35 nativespace-cdp sshd[462736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.92.113.49
Sep 11 04:42:38 nativespace-cdp sshd[462736]: Failed password for invalid user maman from 157.92.113.49 port 57987 ssh2
Sep 11 04:42:38 nativespace-cdp sshd[462736]: Received disconnect from 157.92.113.49 port 57987:11: Bye Bye [preauth]
Sep 11 04:42:38 nativespace-cdp sshd[462736]: Disconnected from 157.92.113.49 port 57987 [preauth]
Sep 11 04:43:06 nativespace-cdp sshd[462827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.244.184.15  user=root
Sep 11 04:43:06 nativespace-cdp sshd[462827]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 04:43:08 nativespace-cdp sshd[462827]: Failed password for root from 143.244.184.15 port 39768 ssh2
Sep 11 04:43:08 nativespace-cdp sshd[462827]: Received disconnect from 143.244.184.15 port 39768:11: Bye Bye [preauth]
Sep 11 04:43:08 nativespace-cdp sshd[462827]: Disconnected from 143.244.184.15 port 39768 [preauth]
Sep 11 04:46:25 nativespace-cdp sshd[464096]: Invalid user admin from 51.77.245.237 port 35514
Sep 11 04:46:25 nativespace-cdp sshd[464096]: input_userauth_request: invalid user admin [preauth]
Sep 11 04:46:25 nativespace-cdp sshd[464096]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:46:25 nativespace-cdp sshd[464096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.245.237
Sep 11 04:46:27 nativespace-cdp sshd[464096]: Failed password for invalid user admin from 51.77.245.237 port 35514 ssh2
Sep 11 04:46:27 nativespace-cdp sshd[464096]: Received disconnect from 51.77.245.237 port 35514:11: Bye Bye [preauth]
Sep 11 04:46:27 nativespace-cdp sshd[464096]: Disconnected from 51.77.245.237 port 35514 [preauth]
Sep 11 04:46:34 nativespace-cdp sshd[464118]: Connection closed by 159.100.136.21 port 56658 [preauth]
Sep 11 04:46:35 nativespace-cdp sshd[464108]: Invalid user greg from 154.92.16.119 port 48876
Sep 11 04:46:35 nativespace-cdp sshd[464108]: input_userauth_request: invalid user greg [preauth]
Sep 11 04:46:35 nativespace-cdp sshd[464108]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:46:35 nativespace-cdp sshd[464108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.92.16.119
Sep 11 04:46:37 nativespace-cdp sshd[464108]: Failed password for invalid user greg from 154.92.16.119 port 48876 ssh2
Sep 11 04:46:37 nativespace-cdp sshd[464108]: Received disconnect from 154.92.16.119 port 48876:11: Bye Bye [preauth]
Sep 11 04:46:37 nativespace-cdp sshd[464108]: Disconnected from 154.92.16.119 port 48876 [preauth]
Sep 11 04:46:47 nativespace-cdp sshd[464142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.244.227  user=root
Sep 11 04:46:47 nativespace-cdp sshd[464142]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 04:46:49 nativespace-cdp sshd[464142]: Failed password for root from 200.13.244.227 port 48838 ssh2
Sep 11 04:46:49 nativespace-cdp sshd[464142]: Received disconnect from 200.13.244.227 port 48838:11: Bye Bye [preauth]
Sep 11 04:46:49 nativespace-cdp sshd[464142]: Disconnected from 200.13.244.227 port 48838 [preauth]
Sep 11 04:46:50 nativespace-cdp sshd[464154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.86.4  user=root
Sep 11 04:46:50 nativespace-cdp sshd[464154]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 04:46:51 nativespace-cdp sshd[464154]: Failed password for root from 198.12.86.4 port 57342 ssh2
Sep 11 04:46:53 nativespace-cdp sshd[464154]: Received disconnect from 198.12.86.4 port 57342:11: Bye Bye [preauth]
Sep 11 04:46:53 nativespace-cdp sshd[464154]: Disconnected from 198.12.86.4 port 57342 [preauth]
Sep 11 04:47:04 nativespace-cdp sshd[464204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.245.237  user=root
Sep 11 04:47:04 nativespace-cdp sshd[464204]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 04:47:07 nativespace-cdp sshd[464204]: Failed password for root from 51.77.245.237 port 48274 ssh2
Sep 11 04:47:07 nativespace-cdp sshd[464204]: Received disconnect from 51.77.245.237 port 48274:11: Bye Bye [preauth]
Sep 11 04:47:07 nativespace-cdp sshd[464204]: Disconnected from 51.77.245.237 port 48274 [preauth]
Sep 11 04:47:08 nativespace-cdp sshd[464216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.92.113.49  user=root
Sep 11 04:47:08 nativespace-cdp sshd[464216]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 04:47:10 nativespace-cdp sshd[464216]: Failed password for root from 157.92.113.49 port 47786 ssh2
Sep 11 04:47:19 nativespace-cdp sshd[464267]: Invalid user j from 154.92.16.119 port 33806
Sep 11 04:47:19 nativespace-cdp sshd[464267]: input_userauth_request: invalid user j [preauth]
Sep 11 04:47:19 nativespace-cdp sshd[464267]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:47:19 nativespace-cdp sshd[464267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.92.16.119
Sep 11 04:47:21 nativespace-cdp sshd[464267]: Failed password for invalid user j from 154.92.16.119 port 33806 ssh2
Sep 11 04:47:26 nativespace-cdp sshd[464267]: Received disconnect from 154.92.16.119 port 33806:11: Bye Bye [preauth]
Sep 11 04:47:26 nativespace-cdp sshd[464267]: Disconnected from 154.92.16.119 port 33806 [preauth]
Sep 11 04:47:35 nativespace-cdp sshd[464216]: Received disconnect from 157.92.113.49 port 47786:11: Bye Bye [preauth]
Sep 11 04:47:35 nativespace-cdp sshd[464216]: Disconnected from 157.92.113.49 port 47786 [preauth]
Sep 11 04:47:38 nativespace-cdp sshd[464372]: Invalid user distro from 198.12.86.4 port 42294
Sep 11 04:47:38 nativespace-cdp sshd[464372]: input_userauth_request: invalid user distro [preauth]
Sep 11 04:47:38 nativespace-cdp sshd[464372]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:47:38 nativespace-cdp sshd[464372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.86.4
Sep 11 04:47:40 nativespace-cdp sshd[464372]: Failed password for invalid user distro from 198.12.86.4 port 42294 ssh2
Sep 11 04:47:40 nativespace-cdp sshd[464372]: Received disconnect from 198.12.86.4 port 42294:11: Bye Bye [preauth]
Sep 11 04:47:40 nativespace-cdp sshd[464372]: Disconnected from 198.12.86.4 port 42294 [preauth]
Sep 11 04:48:07 nativespace-cdp sshd[464472]: Invalid user adempiere from 157.92.113.49 port 55527
Sep 11 04:48:07 nativespace-cdp sshd[464472]: input_userauth_request: invalid user adempiere [preauth]
Sep 11 04:48:07 nativespace-cdp sshd[464472]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:48:07 nativespace-cdp sshd[464472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.92.113.49
Sep 11 04:48:09 nativespace-cdp sshd[464472]: Failed password for invalid user adempiere from 157.92.113.49 port 55527 ssh2
Sep 11 04:48:16 nativespace-cdp sshd[464521]: Invalid user greg from 143.244.184.15 port 57600
Sep 11 04:48:16 nativespace-cdp sshd[464521]: input_userauth_request: invalid user greg [preauth]
Sep 11 04:48:16 nativespace-cdp sshd[464521]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 04:48:16 nativespace-cdp sshd[464521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.244.184.15
Sep 11 04:48:18 nativespace-cdp sshd[464521]: Failed password for invalid user greg from 143.244.184.15 port 57600 ssh2
Sep 11 04:48:18 nativespace-cdp sshd[464521]: Received disconnect from 143.244.184.15 port 57600:11: Bye Bye [preauth]
Sep 11 04:48:18 nativespace-cdp sshd[464521]: Disconnected from 143.244.184.15 port 57600 [preauth]
Sep 11 04:51:35 nativespace-cdp sshd[465368]: Connection closed by 159.100.136.21 port 37706 [preauth]
Sep 11 04:52:44 nativespace-cdp sshd[465536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.244.227  user=root
Sep 11 04:52:44 nativespace-cdp sshd[465536]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 04:52:46 nativespace-cdp sshd[465536]: Failed password for root from 200.13.244.227 port 60388 ssh2
Sep 11 04:52:53 nativespace-cdp sshd[465536]: Received disconnect from 200.13.244.227 port 60388:11: Bye Bye [preauth]
Sep 11 04:52:53 nativespace-cdp sshd[465536]: Disconnected from 200.13.244.227 port 60388 [preauth]
Sep 11 04:54:07 nativespace-cdp sshd[465861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.244.227  user=root
Sep 11 04:54:07 nativespace-cdp sshd[465861]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 04:54:10 nativespace-cdp sshd[465861]: Failed password for root from 200.13.244.227 port 39144 ssh2
Sep 11 04:54:29 nativespace-cdp sshd[465957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.244.184.15  user=root
Sep 11 04:54:29 nativespace-cdp sshd[465957]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 04:54:31 nativespace-cdp sshd[465957]: Failed password for root from 143.244.184.15 port 46122 ssh2
Sep 11 04:56:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 04:56:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:56:24 nativespace-cdp sudo[466442]: pam_unix(sudo:session): session closed for user root
Sep 11 04:56:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 04:56:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:56:24 nativespace-cdp sudo[466455]: pam_unix(sudo:session): session closed for user root
Sep 11 04:56:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 04:56:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:56:28 nativespace-cdp sudo[466465]: pam_unix(sudo:session): session closed for user root
Sep 11 04:56:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=sibtoncc user-2=asandcoc user-3=steve user-4=bwppodcast user-5=zebrapho user-6=nsceres user-7=fawcettd user-8=burydropin user-9=dhyana user-10=beauty user-11=darkstar user-12=eatspam user-13=lkpier user-14=firstre5 user-15=donnychicago user-16=steakbridieme user-17=philmcph user-18=ctedorgu user-19=nscdp user-20=putterfc user-21=leftie user-22=foods user-23=health2045 user-24=fortunaz user-25=nomistakes user-26=hidden user-27=tigerlet user-28=barbersh user-29=smrszyqg user-30=isleofwi user-31=cwsocial user-32=howardon user-33=paulmca1 user-34=pugwash user-35=cambria1 user-36=cathski user-37=reliable user-38=ninejimm user-39=eugincou user-40=courseme user-41=hirefootballgame user-42=jennimil user-43=tomandle user-44=david user-45=nbhavers user-46=careers user-47=chrisdal user-48=mcdermos
Sep 11 04:56:28 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=lucy user-51=attlebor user-52=romaldki user-53=ranxterc user-54=hodgsonmail user-55=outdoorc user-56=branko user-57=boldover user-58=nove user-59=bakery user-60=crrtipdl user-61=sosevalu user-62=havantho user-63=cath user-64=sketchy user-65=nvihkvu user-66=tstardom user-67=oubpgvbx user-68=what user-69=design user-70=dancinggardener user-71=stagingerris user-72=ladburyp user-73=kategilpin user-74=vantagep user-75=athenare user-76=connect9 user-77=lbscrmod user-78=maflemin user-79=booff user-80=markward user-81=foundation user-82=ulsukarm user-83=spectrum user-84=theblack user-85=hodgesonweb user-86=jarvisin user-87=stephani user-88=leereyn1 user-89=agproduc user-90=still user-91=strathar user-92=atestord user-93=sarafoundation user-94=brmrjxl user-95=lakesan1 user-96=megacards user-97=musorguk user-98=wilsonsw user-99=dickemery123 user-100=ptkxhsbt user-101=martsblo user-102=magichat
Sep 11 04:56:28 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=hhdugcor user-104=lbhyisi user-105=opaiscyx user-106=coursemc user-107=ultbcrra user-108=seftvta user-109=jonhartl user-110=firstres user-111=firstred user-112=highlegh user-113=southlon user-114=firstrel user-115=clarkass user-116=costestimatorco user-117=putterfi user-118=hubmaster user-119=fetch user-120=carsinyo user-121=gilpin user-122=milloyco user-123=elecleis user-124=connectedshoppin user-125=thqkgnbz user-126=accooper user-127=ianrayne user-128=vivienn1 user-129=firstre2 user-130=oneoarco user-131=battlere user-132=nstriton user-133=brighto1 user-134=newstoda user-135=belle user-136=ggaaorgu user-137=bemadonn user-138=bedfords user-139=skyfirec user-140=alexadmin user-141=nativene user-142=innovat1 user-143=stuartge user-144=askhform feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 04:56:28 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 04:56:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:56:30 nativespace-cdp sudo[466492]: pam_unix(sudo:session): session closed for user root
Sep 11 04:56:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 11 04:56:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:56:32 nativespace-cdp sudo[466612]: pam_unix(sudo:session): session closed for user root
Sep 11 04:56:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=onlycont --output=json
Sep 11 04:56:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:56:32 nativespace-cdp sudo[466617]: pam_unix(sudo:session): session closed for user root
Sep 11 04:56:35 nativespace-cdp sshd[466635]: Connection closed by 159.100.136.21 port 47078 [preauth]
Sep 11 04:56:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 11 04:56:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 04:56:57 nativespace-cdp sudo[466728]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 04:56:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user onlycont --user-current --json
Sep 11 04:56:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:56:58 nativespace-cdp sudo[466734]: pam_unix(sudo:session): session closed for user root
Sep 11 04:56:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont LangPHP php_get_vhost_versions --output=json
Sep 11 04:56:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:57:00 nativespace-cdp sudo[466743]: pam_unix(sudo:session): session closed for user root
Sep 11 04:57:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep 11 04:57:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:57:02 nativespace-cdp sudo[466748]: pam_unix(sudo:session): session closed for user root
Sep 11 04:57:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 11 04:57:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:57:02 nativespace-cdp sudo[466774]: pam_unix(sudo:session): session closed for user root
Sep 11 04:57:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DomainInfo single_domain_data domain=apexred.com return_https_redirect_status=1 --output=json
Sep 11 04:57:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:57:04 nativespace-cdp sudo[466788]: pam_unix(sudo:session): session closed for user root
Sep 11 04:57:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep 11 04:57:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:57:08 nativespace-cdp sudo[466797]: pam_unix(sudo:session): session closed for user root
Sep 11 04:57:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep 11 04:57:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:57:09 nativespace-cdp sudo[466809]: pam_unix(sudo:session): session closed for user root
Sep 11 04:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont Mime list_redirects --output=json
Sep 11 04:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:57:09 nativespace-cdp sudo[466815]: pam_unix(sudo:session): session closed for user root
Sep 11 04:57:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DirectoryPrivacy is_directory_protected dir=/home/onlycont/public_html/wp --output=json
Sep 11 04:57:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:57:15 nativespace-cdp sudo[466956]: pam_unix(sudo:session): session closed for user root
Sep 11 04:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 11 04:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 04:57:18 nativespace-cdp sudo[467014]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 04:57:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 11 04:57:18 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 11 04:57:18 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 11 04:57:18 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 04:57:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 04:57:19 nativespace-cdp sudo[467021]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 04:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 11 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 11 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 11 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 04:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 04:57:20 nativespace-cdp sudo[467027]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 04:57:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 11 04:57:20 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 11 04:57:20 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 11 04:57:20 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 04:57:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 04:57:22 nativespace-cdp sudo[467034]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 11 04:59:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 04:59:20 nativespace-cdp sudo[467992]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 04:59:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 04:59:20 nativespace-cdp sudo[467999]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 04:59:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 04:59:20 nativespace-cdp sudo[468005]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 11 04:59:20 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 04:59:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 04:59:20 nativespace-cdp sudo[468013]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 11 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:59:22 nativespace-cdp sudo[468047]: pam_unix(sudo:session): session closed for user root
Sep 11 04:59:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep 11 04:59:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:59:22 nativespace-cdp sudo[468052]: pam_unix(sudo:session): session closed for user root
Sep 11 04:59:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 11 04:59:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 04:59:41 nativespace-cdp sudo[468150]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 04:59:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 11 04:59:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:59:41 nativespace-cdp sudo[468157]: pam_unix(sudo:session): session closed for user root
Sep 11 04:59:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep 11 04:59:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:59:42 nativespace-cdp sudo[468163]: pam_unix(sudo:session): session closed for user root
Sep 11 04:59:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep 11 04:59:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:59:43 nativespace-cdp sudo[468167]: pam_unix(sudo:session): session closed for user root
Sep 11 04:59:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 11 04:59:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:59:43 nativespace-cdp sudo[468176]: pam_unix(sudo:session): session closed for user root
Sep 11 04:59:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep 11 04:59:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:59:46 nativespace-cdp sudo[468192]: pam_unix(sudo:session): session closed for user root
Sep 11 04:59:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep 11 04:59:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:59:46 nativespace-cdp sudo[468197]: pam_unix(sudo:session): session closed for user root
Sep 11 04:59:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep 11 04:59:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 04:59:53 nativespace-cdp sudo[468275]: pam_unix(sudo:session): session closed for user root
Sep 11 04:59:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 11 04:59:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 04:59:56 nativespace-cdp sudo[468335]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 04:59:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 11 04:59:56 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 11 04:59:56 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 11 04:59:56 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 04:59:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 04:59:56 nativespace-cdp sudo[468341]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 04:59:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 11 04:59:56 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 11 04:59:56 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 11 04:59:56 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 04:59:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:00:21 nativespace-cdp sudo[468348]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:01:33 nativespace-cdp sshd[468983]: Connection closed by 159.100.136.21 port 56522 [preauth]
Sep 11 05:05:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 11 05:05:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:05:06 nativespace-cdp sudo[469748]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:05:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 11 05:05:06 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 11 05:05:06 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 11 05:05:06 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:05:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:05:07 nativespace-cdp sudo[469754]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:05:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 11 05:05:07 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 11 05:05:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 11 05:05:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:05:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:05:07 nativespace-cdp sudo[469760]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 11 05:05:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:05:09 nativespace-cdp sudo[469799]: pam_unix(sudo:session): session closed for user root
Sep 11 05:05:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep 11 05:05:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:05:10 nativespace-cdp sudo[469803]: pam_unix(sudo:session): session closed for user root
Sep 11 05:05:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 11 05:05:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 05:05:28 nativespace-cdp sudo[469921]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 05:05:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep 11 05:05:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:05:29 nativespace-cdp sudo[469928]: pam_unix(sudo:session): session closed for user root
Sep 11 05:05:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep 11 05:05:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:05:29 nativespace-cdp sudo[469933]: pam_unix(sudo:session): session closed for user root
Sep 11 05:05:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 11 05:05:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:05:29 nativespace-cdp sudo[469938]: pam_unix(sudo:session): session closed for user root
Sep 11 05:05:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep 11 05:05:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:05:30 nativespace-cdp sudo[469952]: pam_unix(sudo:session): session closed for user root
Sep 11 05:05:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep 11 05:05:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:05:30 nativespace-cdp sudo[469958]: pam_unix(sudo:session): session closed for user root
Sep 11 05:05:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep 11 05:05:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:05:56 nativespace-cdp sudo[470071]: pam_unix(sudo:session): session closed for user root
Sep 11 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 11 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 05:05:59 nativespace-cdp sudo[470133]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 11 05:05:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 11 05:05:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 11 05:05:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 05:05:59 nativespace-cdp sudo[470139]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 05:05:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 11 05:05:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 11 05:05:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 11 05:05:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:05:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 05:06:15 nativespace-cdp sudo[470146]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 05:06:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 11 05:06:15 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 11 05:06:15 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 11 05:06:15 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:06:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 05:06:17 nativespace-cdp sudo[470250]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 05:06:35 nativespace-cdp sshd[470425]: Connection closed by 159.100.136.21 port 36130 [preauth]
Sep 11 05:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 05:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:20 nativespace-cdp sudo[470997]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 05:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:20 nativespace-cdp sudo[471001]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 05:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:21 nativespace-cdp sudo[471004]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 05:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:21 nativespace-cdp sudo[471008]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 05:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:23 nativespace-cdp sudo[471011]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 05:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:23 nativespace-cdp sudo[471023]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 05:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:23 nativespace-cdp sudo[471026]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 05:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:23 nativespace-cdp sudo[471029]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 05:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:23 nativespace-cdp sudo[471032]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 05:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:23 nativespace-cdp sudo[471035]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 05:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:23 nativespace-cdp sudo[471038]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 05:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:47 nativespace-cdp sudo[471146]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 05:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:47 nativespace-cdp sudo[471150]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=burydropin user-2=fawcettd user-3=nsceres user-4=eatspam user-5=darkstar user-6=beauty user-7=dhyana user-8=sibtoncc user-9=asandcoc user-10=zebrapho user-11=bwppodcast user-12=steve user-13=reliable user-14=ninejimm user-15=cathski user-16=cambria1 user-17=pugwash user-18=paulmca1 user-19=howardon user-20=cwsocial user-21=hirefootballgame user-22=courseme user-23=eugincou user-24=health2045 user-25=fortunaz user-26=leftie user-27=foods user-28=putterfc user-29=nscdp user-30=philmcph user-31=ctedorgu user-32=firstre5 user-33=steakbridieme user-34=donnychicago user-35=lkpier user-36=smrszyqg user-37=isleofwi user-38=barbersh user-39=tigerlet user-40=hidden user-41=nomistakes user-42=attlebor user-43=lucy user-44=onlycont user-45=branko user-46=hodgsonmail user-47=outdoorc user-48=ranxterc
Sep 11 05:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=tomandle user-51=jennimil user-52=mcdermos user-53=chrisdal user-54=nbhavers user-55=careers user-56=david user-57=what user-58=tstardom user-59=oubpgvbx user-60=nvihkvu user-61=sketchy user-62=cath user-63=havantho user-64=kategilpin user-65=ladburyp user-66=dancinggardener user-67=stagingerris user-68=design user-69=nove user-70=boldover user-71=sosevalu user-72=crrtipdl user-73=bakery user-74=jarvisin user-75=hodgesonweb user-76=theblack user-77=spectrum user-78=still user-79=agproduc user-80=leereyn1 user-81=stephani user-82=booff user-83=markward user-84=foundation user-85=maflemin user-86=lbscrmod user-87=connect9 user-88=athenare user-89=vantagep user-90=ulsukarm user-91=martsblo user-92=ptkxhsbt user-93=dickemery123 user-94=lbhyisi user-95=hhdugcor user-96=magichat user-97=lakesan1 user-98=brmrjxl user-99=sarafoundation user-100=atestord user-101=strathar user-102=wilsonsw
Sep 11 05:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=musorguk user-104=megacards user-105=elecleis user-106=gilpin user-107=milloyco user-108=carsinyo user-109=fetch user-110=putterfi user-111=hubmaster user-112=ianrayne user-113=accooper user-114=thqkgnbz user-115=connectedshoppin user-116=firstres user-117=jonhartl user-118=seftvta user-119=ultbcrra user-120=opaiscyx user-121=coursemc user-122=costestimatorco user-123=firstrel user-124=clarkass user-125=southlon user-126=highlegh user-127=firstred user-128=skyfirec user-129=alexadmin user-130=stuartge user-131=askhform user-132=innovat1 user-133=nativene user-134=brighto1 user-135=nstriton user-136=battlere user-137=oneoarco user-138=firstre2 user-139=vivienn1 user-140=bedfords user-141=bemadonn user-142=belle user-143=ggaaorgu user-144=newstoda feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 05:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 05:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:47 nativespace-cdp sudo[471155]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:48 nativespace-cdp sudo[471164]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UpBS5rH0sMKTVZWY.~
Sep 11 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:48 nativespace-cdp sudo[471170]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UpBS5rH0sMKTVZWY.~'
Sep 11 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:48 nativespace-cdp sudo[471173]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UpBS5rH0sMKTVZWY.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:48 nativespace-cdp sudo[471177]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 05:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:48 nativespace-cdp sudo[471180]: pam_unix(sudo:session): session closed for user root
Sep 11 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:09:50 nativespace-cdp sudo[471203]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 11 05:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 05:10:02 nativespace-cdp sudo[471425]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 05:10:02 nativespace-cdp sudo[471431]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 05:10:02 nativespace-cdp sudo[471437]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 11 05:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 05:10:02 nativespace-cdp sudo[471447]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 05:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 11 05:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:05 nativespace-cdp sudo[471492]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep 11 05:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:05 nativespace-cdp sudo[471496]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep 11 05:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:06 nativespace-cdp sudo[471512]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep 11 05:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:06 nativespace-cdp sudo[471519]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 11 05:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 11 05:10:07 nativespace-cdp sudo[471530]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 11 05:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep 11 05:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:08 nativespace-cdp sudo[471536]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep 11 05:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:08 nativespace-cdp sudo[471542]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 11 05:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:08 nativespace-cdp sudo[471548]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 11 05:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:10:26 nativespace-cdp sudo[471640]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 11 05:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:26 nativespace-cdp sudo[471646]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 11 05:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:26 nativespace-cdp sudo[471652]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep 11 05:10:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:28 nativespace-cdp sudo[471664]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep 11 05:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:10:32 nativespace-cdp sudo[471736]: pam_unix(sudo:session): session closed for user root
Sep 11 05:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 11 05:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:10:35 nativespace-cdp sudo[471841]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 11 05:10:35 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 11 05:10:35 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 11 05:10:35 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:10:36 nativespace-cdp sudo[471848]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 11 05:10:36 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 11 05:10:36 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 11 05:10:36 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:10:53 nativespace-cdp sudo[471855]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:11:36 nativespace-cdp sshd[472347]: Connection closed by 159.100.136.21 port 44956 [preauth]
Sep 11 05:14:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 11 05:14:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:14:24 nativespace-cdp sudo[473294]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:14:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 11 05:14:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 11 05:14:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 11 05:14:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:14:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:14:24 nativespace-cdp sudo[473300]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:14:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 11 05:14:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 11 05:14:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 11 05:14:24 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 11 05:14:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 05:14:24 nativespace-cdp sudo[473306]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 05:14:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 11 05:14:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:14:27 nativespace-cdp sudo[473343]: pam_unix(sudo:session): session closed for user root
Sep 11 05:14:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep 11 05:14:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:14:27 nativespace-cdp sudo[473351]: pam_unix(sudo:session): session closed for user root
Sep 11 05:14:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 11 05:14:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 11 05:14:35 nativespace-cdp sudo[473414]: pam_unix(sudo:session): session closed for user fortunaz
Sep 11 05:14:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep 11 05:14:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:14:35 nativespace-cdp sudo[473420]: pam_unix(sudo:session): session closed for user root
Sep 11 05:14:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep 11 05:14:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:14:36 nativespace-cdp sudo[473425]: pam_unix(sudo:session): session closed for user root
Sep 11 05:14:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 11 05:14:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:14:36 nativespace-cdp sudo[473429]: pam_unix(sudo:session): session closed for user root
Sep 11 05:14:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep 11 05:14:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:14:38 nativespace-cdp sudo[473447]: pam_unix(sudo:session): session closed for user root
Sep 11 05:14:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep 11 05:14:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:14:39 nativespace-cdp sudo[473452]: pam_unix(sudo:session): session closed for user root
Sep 11 05:14:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep 11 05:14:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:14:43 nativespace-cdp sudo[473518]: pam_unix(sudo:session): session closed for user root
Sep 11 05:14:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=sibtoncc WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "Fluent Forms" on ONE | OAR (https://oneoar.co.uk). Installed version: 4.3.22. Available version: 5.2.1.<br/><br/>2. Plugin "Jetpack" on Limekilns Heritage Trust (https://limekilnspier.org.uk). Installed version: 13.1.1. Available version: 13.8.1.<br/><br/>3. Plugin "Jetpack" on Pinstripe Inventories (https://pinstripe.services). Installed version: 12.8.1. Available version: 13.8.1.<br/><br/>' 'installed_updates_text=<br/><br/>Updates were automatically installed for the following items:<br/><br/>' 'installed_updates_list=1. Website "ApexRed IR" (https://apexred.com/wp). New version: 6.6.2. Previous version: 6.6.1.<br/><br/>2. Website
Sep 11 05:14:54 nativespace-cdp sudo: wp-toolkit : (command continued) "ONE | OAR" (https://oneoar.co.uk). New version: 6.6.2. Previous version: 6.6.1.<br/><br/>3. Website "Limekilns Heritage Trust" (https://limekilnspier.org.uk). New version: 6.6.2. Previous version: 6.6.1.<br/><br/>4. Website "Pinstripe Inventories" (https://pinstripe.services). New version: 6.6.2. Previous version: 6.6.1.<br/><br/>' 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep 11 05:14:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:14:55 nativespace-cdp sudo[473715]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473831]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473834]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473837]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473841]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473844]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473847]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473850]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473853]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473856]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473859]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473862]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473865]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473868]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473872]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473875]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473878]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473881]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473884]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473888]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:00 nativespace-cdp sudo[473891]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[473894]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[473897]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[473900]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[473903]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[473906]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[473909]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[473912]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[473915]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[473988]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474010]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474014]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474018]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474021]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474025]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474029]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474034]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474037]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474040]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474048]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474056]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474060]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474063]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474068]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:01 nativespace-cdp sudo[474071]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474077]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474081]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474085]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474093]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474096]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474100]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474105]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474110]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474116]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474119]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474122]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474129]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474134]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474137]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474140]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:02 nativespace-cdp sudo[474143]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474147]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474154]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474158]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474161]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474164]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474167]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474171]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474175]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474178]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474181]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474184]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474188]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474191]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474194]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474197]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474200]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474203]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474206]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474209]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474212]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474215]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474218]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474221]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474224]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474227]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:03 nativespace-cdp sudo[474232]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474235]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474238]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474241]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474244]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474247]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474250]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474253]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474258]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474261]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474264]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474267]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474270]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474273]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474276]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474279]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474283]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474286]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474289]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474292]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474295]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474298]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474301]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474305]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474308]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474311]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474314]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474317]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474320]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 11 05:15:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:04 nativespace-cdp sudo[474323]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474326]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474329]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474332]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474335]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474338]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474341]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474344]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474347]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474350]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474353]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474356]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474359]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474362]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474365]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474368]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474373]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474376]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474379]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474382]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474386]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474389]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474392]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474395]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474398]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474401]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474404]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474407]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474410]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474413]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474416]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474419]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474422]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474425]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474428]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474431]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474435]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474438]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:05 nativespace-cdp sudo[474441]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474444]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474447]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474450]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474453]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474456]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474459]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474462]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474465]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474468]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474471]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474474]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474477]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474480]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474483]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474486]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474489]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474492]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474495]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474498]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474502]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474505]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474508]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474511]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474514]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474517]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474520]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474523]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474526]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474529]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474532]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474535]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474538]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474541]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474544]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474547]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:06 nativespace-cdp sudo[474550]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474553]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474556]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474559]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474562]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474565]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474568]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474571]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474574]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474577]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474580]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474583]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474586]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474589]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474592]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474595]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474598]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474601]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474604]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474607]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474610]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474614]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474617]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474620]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474623]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474626]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474629]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474632]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474635]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474638]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474641]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474644]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474647]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474650]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474653]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474656]: pam_unix(sudo:session): session closed for user root
Sep 11 05:15:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 11 05:15:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 05:15:07 nativespace-cdp sudo[474660]: pam_unix(sudo:session): session closed for user root
Sep 11 05:16:33 nativespace-cdp sshd[474966]: Connection closed by 159.100.136.21 port 54812 [preauth]
Sep 11 05:21:33 nativespace-cdp sshd[476053]: Connection closed by 159.100.136.21 port 35616 [preauth]
Sep 11 05:26:35 nativespace-cdp sshd[477106]: Connection closed by 159.100.136.21 port 44422 [preauth]
Sep 11 05:31:33 nativespace-cdp sshd[478463]: Connection closed by 159.100.136.21 port 53944 [preauth]
Sep 11 05:35:10 nativespace-cdp su: pam_unix(su:session): session opened for user beauty by (uid=0)
Sep 11 05:35:10 nativespace-cdp su[479564]: pam_unix(su:session): session closed for user beauty
Sep 11 05:36:33 nativespace-cdp sshd[479830]: Connection closed by 159.100.136.21 port 34972 [preauth]
Sep 11 05:41:33 nativespace-cdp sshd[480925]: Connection closed by 159.100.136.21 port 44352 [preauth]
Sep 11 05:46:41 nativespace-cdp sshd[482202]: Connection closed by 159.100.136.21 port 53990 [preauth]
Sep 11 05:51:33 nativespace-cdp sshd[483460]: Connection closed by 159.100.136.21 port 34592 [preauth]
Sep 11 05:56:33 nativespace-cdp sshd[484630]: Connection closed by 159.100.136.21 port 43556 [preauth]
Sep 11 06:06:33 nativespace-cdp sshd[487131]: Connection closed by 159.100.136.21 port 33242 [preauth]
Sep 11 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:21 nativespace-cdp sudo[487668]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:21 nativespace-cdp sudo[487672]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:21 nativespace-cdp sudo[487676]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:21 nativespace-cdp sudo[487681]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 06:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:25 nativespace-cdp sudo[487684]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 06:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:25 nativespace-cdp sudo[487703]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 06:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:25 nativespace-cdp sudo[487706]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 06:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:25 nativespace-cdp sudo[487709]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 06:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:25 nativespace-cdp sudo[487712]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 06:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:25 nativespace-cdp sudo[487715]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 06:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:25 nativespace-cdp sudo[487718]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 06:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:30 nativespace-cdp sudo[487752]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 06:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:30 nativespace-cdp sudo[487758]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=mcdermos user-4=chrisdal user-5=nbhavers user-6=careers user-7=david user-8=attlebor user-9=lucy user-10=onlycont user-11=branko user-12=hodgsonmail user-13=ranxterc user-14=outdoorc user-15=romaldki user-16=nove user-17=boldover user-18=sosevalu user-19=crrtipdl user-20=bakery user-21=what user-22=tstardom user-23=oubpgvbx user-24=nvihkvu user-25=cath user-26=sketchy user-27=havantho user-28=kategilpin user-29=ladburyp user-30=stagingerris user-31=dancinggardener user-32=design user-33=asandcoc user-34=sibtoncc user-35=zebrapho user-36=bwppodcast user-37=steve user-38=burydropin user-39=fawcettd user-40=nsceres user-41=eatspam user-42=darkstar user-43=beauty user-44=dhyana user-45=health2045 user-46=fortunaz user-47=foods user-48=leftie user-49=putterfc
Sep 11 06:09:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=nscdp user-51=ctedorgu user-52=philmcph user-53=steakbridieme user-54=donnychicago user-55=firstre5 user-56=lkpier user-57=smrszyqg user-58=isleofwi user-59=tigerlet user-60=barbersh user-61=hidden user-62=nomistakes user-63=reliable user-64=ninejimm user-65=cathski user-66=cambria1 user-67=pugwash user-68=paulmca1 user-69=howardon user-70=cwsocial user-71=hirefootballgame user-72=courseme user-73=eugincou user-74=firstres user-75=jonhartl user-76=seftvta user-77=ultbcrra user-78=coursemc user-79=opaiscyx user-80=costestimatorco user-81=firstrel user-82=clarkass user-83=southlon user-84=highlegh user-85=firstred user-86=elecleis user-87=milloyco user-88=gilpin user-89=carsinyo user-90=fetch user-91=hubmaster user-92=putterfi user-93=ianrayne user-94=accooper user-95=thqkgnbz user-96=connectedshoppin user-97=brighto1 user-98=nstriton user-99=battlere user-100=oneoarco user-101=firstre2 user-102=vivienn1
Sep 11 06:09:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=bemadonn user-105=belle user-106=ggaaorgu user-107=newstoda user-108=alexadmin user-109=skyfirec user-110=askhform user-111=stuartge user-112=innovat1 user-113=nativene user-114=booff user-115=markward user-116=foundation user-117=maflemin user-118=lbscrmod user-119=athenare user-120=connect9 user-121=vantagep user-122=ulsukarm user-123=jarvisin user-124=theblack user-125=hodgesonweb user-126=spectrum user-127=still user-128=agproduc user-129=leereyn1 user-130=stephani user-131=brmrjxl user-132=lakesan1 user-133=sarafoundation user-134=atestord user-135=strathar user-136=wilsonsw user-137=musorguk user-138=megacards user-139=martsblo user-140=ptkxhsbt user-141=dickemery123 user-142=lbhyisi user-143=hhdugcor user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 06:09:30 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 06:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:31 nativespace-cdp sudo[487764]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 06:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:31 nativespace-cdp sudo[487769]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-uUhK0UXwVH52o5ZL.~
Sep 11 06:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:31 nativespace-cdp sudo[487772]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-uUhK0UXwVH52o5ZL.~'
Sep 11 06:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:31 nativespace-cdp sudo[487775]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-uUhK0UXwVH52o5ZL.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 06:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:31 nativespace-cdp sudo[487779]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 06:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:31 nativespace-cdp sudo[487783]: pam_unix(sudo:session): session closed for user root
Sep 11 06:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 06:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 06:09:32 nativespace-cdp sudo[487806]: pam_unix(sudo:session): session closed for user root
Sep 11 06:11:33 nativespace-cdp sshd[488398]: Connection closed by 159.100.136.21 port 42422 [preauth]
Sep 11 06:16:33 nativespace-cdp sshd[489849]: Connection closed by 159.100.136.21 port 51958 [preauth]
Sep 11 06:21:33 nativespace-cdp sshd[491112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.74.4.17  user=root
Sep 11 06:21:33 nativespace-cdp sshd[491112]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 06:21:33 nativespace-cdp sshd[491118]: Connection closed by 159.100.136.21 port 60972 [preauth]
Sep 11 06:21:34 nativespace-cdp sshd[491112]: Failed password for root from 185.74.4.17 port 50506 ssh2
Sep 11 06:21:34 nativespace-cdp sshd[491112]: Received disconnect from 185.74.4.17 port 50506:11: Bye Bye [preauth]
Sep 11 06:21:34 nativespace-cdp sshd[491112]: Disconnected from 185.74.4.17 port 50506 [preauth]
Sep 11 06:24:19 nativespace-cdp sshd[491631]: Invalid user bank from 185.74.4.17 port 34851
Sep 11 06:24:19 nativespace-cdp sshd[491631]: input_userauth_request: invalid user bank [preauth]
Sep 11 06:24:19 nativespace-cdp sshd[491631]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 06:24:19 nativespace-cdp sshd[491631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.74.4.17
Sep 11 06:24:21 nativespace-cdp sshd[491631]: Failed password for invalid user bank from 185.74.4.17 port 34851 ssh2
Sep 11 06:24:21 nativespace-cdp sshd[491631]: Received disconnect from 185.74.4.17 port 34851:11: Bye Bye [preauth]
Sep 11 06:24:21 nativespace-cdp sshd[491631]: Disconnected from 185.74.4.17 port 34851 [preauth]
Sep 11 06:25:03 nativespace-cdp sshd[491815]: Invalid user webserver from 185.74.4.17 port 41418
Sep 11 06:25:03 nativespace-cdp sshd[491815]: input_userauth_request: invalid user webserver [preauth]
Sep 11 06:25:03 nativespace-cdp sshd[491815]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 06:25:03 nativespace-cdp sshd[491815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.74.4.17
Sep 11 06:25:06 nativespace-cdp sshd[491815]: Failed password for invalid user webserver from 185.74.4.17 port 41418 ssh2
Sep 11 06:25:09 nativespace-cdp sshd[491815]: Received disconnect from 185.74.4.17 port 41418:11: Bye Bye [preauth]
Sep 11 06:25:09 nativespace-cdp sshd[491815]: Disconnected from 185.74.4.17 port 41418 [preauth]
Sep 11 06:26:33 nativespace-cdp sshd[492440]: Connection closed by 159.100.136.21 port 41548 [preauth]
Sep 11 06:31:33 nativespace-cdp sshd[493828]: Connection closed by 159.100.136.21 port 50578 [preauth]
Sep 11 06:36:33 nativespace-cdp sshd[494945]: Connection closed by 159.100.136.21 port 60250 [preauth]
Sep 11 06:41:35 nativespace-cdp sshd[496086]: Connection closed by 159.100.136.21 port 41168 [preauth]
Sep 11 06:46:34 nativespace-cdp sshd[497613]: Connection closed by 159.100.136.21 port 49802 [preauth]
Sep 11 06:51:34 nativespace-cdp sshd[498748]: Connection closed by 159.100.136.21 port 58970 [preauth]
Sep 11 06:56:33 nativespace-cdp sshd[499947]: Connection closed by 159.100.136.21 port 40624 [preauth]
Sep 11 07:01:33 nativespace-cdp sshd[501507]: Connection closed by 159.100.136.21 port 49382 [preauth]
Sep 11 07:06:38 nativespace-cdp sshd[502596]: Connection closed by 159.100.136.21 port 57700 [preauth]
Sep 11 07:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 07:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:26 nativespace-cdp sudo[503078]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 07:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:26 nativespace-cdp sudo[503081]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 07:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:28 nativespace-cdp sudo[503084]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 07:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:28 nativespace-cdp sudo[503089]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 07:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:31 nativespace-cdp sudo[503092]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 07:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:31 nativespace-cdp sudo[503206]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 07:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:31 nativespace-cdp sudo[503209]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 07:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:31 nativespace-cdp sudo[503212]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 07:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:32 nativespace-cdp sudo[503216]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 07:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:32 nativespace-cdp sudo[503219]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 07:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:32 nativespace-cdp sudo[503222]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:47 nativespace-cdp sudo[503261]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:48 nativespace-cdp sudo[503265]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=asandcoc user-2=sibtoncc user-3=bwppodcast user-4=zebrapho user-5=steve user-6=fawcettd user-7=burydropin user-8=nsceres user-9=beauty user-10=darkstar user-11=eatspam user-12=dhyana user-13=nscdp user-14=putterfc user-15=leftie user-16=foods user-17=fortunaz user-18=health2045 user-19=lkpier user-20=steakbridieme user-21=donnychicago user-22=firstre5 user-23=ctedorgu user-24=philmcph user-25=isleofwi user-26=smrszyqg user-27=nomistakes user-28=hidden user-29=tigerlet user-30=barbersh user-31=cathski user-32=cambria1 user-33=reliable user-34=ninejimm user-35=cwsocial user-36=howardon user-37=paulmca1 user-38=pugwash user-39=hirefootballgame user-40=eugincou user-41=courseme user-42=tomandle user-43=jennimil user-44=chrisdal user-45=mcdermos user-46=david user-47=careers user-48=nbhavers
Sep 11 07:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=lucy user-50=attlebor user-51=onlycont user-52=hodgsonmail user-53=outdoorc user-54=ranxterc user-55=branko user-56=romaldki user-57=nove user-58=boldover user-59=bakery user-60=crrtipdl user-61=sosevalu user-62=oubpgvbx user-63=tstardom user-64=what user-65=havantho user-66=sketchy user-67=cath user-68=nvihkvu user-69=dancinggardener user-70=stagingerris user-71=ladburyp user-72=kategilpin user-73=design user-74=markward user-75=booff user-76=foundation user-77=vantagep user-78=connect9 user-79=athenare user-80=lbscrmod user-81=maflemin user-82=ulsukarm user-83=jarvisin user-84=spectrum user-85=theblack user-86=hodgesonweb user-87=agproduc user-88=still user-89=stephani user-90=leereyn1 user-91=lakesan1 user-92=brmrjxl user-93=strathar user-94=atestord user-95=sarafoundation user-96=wilsonsw user-97=megacards user-98=musorguk user-99=martsblo user-100=dickemery123 user-101=ptkxhsbt user-102=hhdugcor
Sep 11 07:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=lbhyisi user-104=magichat user-105=ultbcrra user-106=seftvta user-107=jonhartl user-108=firstres user-109=opaiscyx user-110=coursemc user-111=clarkass user-112=firstrel user-113=costestimatorco user-114=firstred user-115=highlegh user-116=southlon user-117=gilpin user-118=milloyco user-119=elecleis user-120=putterfi user-121=hubmaster user-122=fetch user-123=carsinyo user-124=accooper user-125=ianrayne user-126=connectedshoppin user-127=thqkgnbz user-128=nstriton user-129=brighto1 user-130=vivienn1 user-131=firstre2 user-132=oneoarco user-133=battlere user-134=bedfords user-135=newstoda user-136=ggaaorgu user-137=belle user-138=bemadonn user-139=alexadmin user-140=skyfirec user-141=innovat1 user-142=stuartge user-143=askhform user-144=nativene feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 07:09:48 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 07:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:49 nativespace-cdp sudo[503270]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:49 nativespace-cdp sudo[503276]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-eVnxrLYK7V3TtR6i.~
Sep 11 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:49 nativespace-cdp sudo[503279]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-eVnxrLYK7V3TtR6i.~'
Sep 11 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:49 nativespace-cdp sudo[503282]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-eVnxrLYK7V3TtR6i.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:49 nativespace-cdp sudo[503286]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 07:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:49 nativespace-cdp sudo[503289]: pam_unix(sudo:session): session closed for user root
Sep 11 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 07:09:51 nativespace-cdp sudo[503310]: pam_unix(sudo:session): session closed for user root
Sep 11 07:11:34 nativespace-cdp sshd[503762]: Connection closed by 159.100.136.21 port 37422 [preauth]
Sep 11 07:16:33 nativespace-cdp sshd[504826]: Connection closed by 159.100.136.21 port 47090 [preauth]
Sep 11 07:21:33 nativespace-cdp sshd[505998]: Connection closed by 159.100.136.21 port 55984 [preauth]
Sep 11 07:26:33 nativespace-cdp sshd[507730]: Connection closed by 159.100.136.21 port 37424 [preauth]
Sep 11 07:31:33 nativespace-cdp sshd[509053]: Connection closed by 159.100.136.21 port 46544 [preauth]
Sep 11 07:33:29 nativespace-cdp sshd[509388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.7.226.128  user=root
Sep 11 07:33:29 nativespace-cdp sshd[509388]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 07:33:31 nativespace-cdp sshd[509388]: Failed password for root from 103.7.226.128 port 50280 ssh2
Sep 11 07:33:32 nativespace-cdp sshd[509388]: Received disconnect from 103.7.226.128 port 50280:11: Bye Bye [preauth]
Sep 11 07:33:32 nativespace-cdp sshd[509388]: Disconnected from 103.7.226.128 port 50280 [preauth]
Sep 11 07:35:51 nativespace-cdp sshd[509993]: Invalid user maman from 103.7.226.128 port 44384
Sep 11 07:35:51 nativespace-cdp sshd[509993]: input_userauth_request: invalid user maman [preauth]
Sep 11 07:35:51 nativespace-cdp sshd[509993]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 07:35:51 nativespace-cdp sshd[509993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.7.226.128
Sep 11 07:35:52 nativespace-cdp sshd[509993]: Failed password for invalid user maman from 103.7.226.128 port 44384 ssh2
Sep 11 07:35:52 nativespace-cdp sshd[509993]: Received disconnect from 103.7.226.128 port 44384:11: Bye Bye [preauth]
Sep 11 07:35:52 nativespace-cdp sshd[509993]: Disconnected from 103.7.226.128 port 44384 [preauth]
Sep 11 07:36:36 nativespace-cdp sshd[510130]: Connection closed by 159.100.136.21 port 56058 [preauth]
Sep 11 07:36:38 nativespace-cdp sshd[510138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.7.226.128  user=root
Sep 11 07:36:38 nativespace-cdp sshd[510138]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 07:36:39 nativespace-cdp sshd[510138]: Failed password for root from 103.7.226.128 port 57626 ssh2
Sep 11 07:41:33 nativespace-cdp sshd[511351]: Connection closed by 159.100.136.21 port 36902 [preauth]
Sep 11 07:46:33 nativespace-cdp sshd[512691]: Connection closed by 159.100.136.21 port 46292 [preauth]
Sep 11 07:51:35 nativespace-cdp sshd[513932]: Connection closed by 159.100.136.21 port 55626 [preauth]
Sep 11 07:56:34 nativespace-cdp sshd[515201]: Connection closed by 159.100.136.21 port 37342 [preauth]
Sep 11 08:01:33 nativespace-cdp sshd[516564]: Connection closed by 159.100.136.21 port 46010 [preauth]
Sep 11 08:04:32 nativespace-cdp sshd[517312]: Invalid user ana from 104.131.67.146 port 48240
Sep 11 08:04:32 nativespace-cdp sshd[517312]: input_userauth_request: invalid user ana [preauth]
Sep 11 08:04:32 nativespace-cdp sshd[517312]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 08:04:32 nativespace-cdp sshd[517312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.67.146
Sep 11 08:04:34 nativespace-cdp sshd[517312]: Failed password for invalid user ana from 104.131.67.146 port 48240 ssh2
Sep 11 08:04:34 nativespace-cdp sshd[517312]: Received disconnect from 104.131.67.146 port 48240:11: Bye Bye [preauth]
Sep 11 08:04:34 nativespace-cdp sshd[517312]: Disconnected from 104.131.67.146 port 48240 [preauth]
Sep 11 08:06:34 nativespace-cdp sshd[517918]: Connection closed by 159.100.136.21 port 55206 [preauth]
Sep 11 08:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 08:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:27 nativespace-cdp sudo[518452]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 08:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:27 nativespace-cdp sudo[518455]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 08:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:28 nativespace-cdp sudo[518458]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:28 nativespace-cdp sudo[518464]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:32 nativespace-cdp sudo[518467]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 08:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:32 nativespace-cdp sudo[518478]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 08:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:33 nativespace-cdp sudo[518482]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 08:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:33 nativespace-cdp sudo[518485]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 08:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:33 nativespace-cdp sudo[518488]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 08:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:33 nativespace-cdp sudo[518491]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 08:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:33 nativespace-cdp sudo[518494]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 08:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:44 nativespace-cdp sudo[518562]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 08:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:44 nativespace-cdp sudo[518566]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=chrisdal user-4=mcdermos user-5=david user-6=careers user-7=nbhavers user-8=lucy user-9=attlebor user-10=onlycont user-11=ranxterc user-12=hodgsonmail user-13=outdoorc user-14=branko user-15=romaldki user-16=nove user-17=boldover user-18=bakery user-19=crrtipdl user-20=sosevalu user-21=tstardom user-22=oubpgvbx user-23=what user-24=havantho user-25=cath user-26=sketchy user-27=nvihkvu user-28=stagingerris user-29=dancinggardener user-30=ladburyp user-31=kategilpin user-32=design user-33=asandcoc user-34=sibtoncc user-35=bwppodcast user-36=zebrapho user-37=steve user-38=fawcettd user-39=burydropin user-40=nsceres user-41=beauty user-42=darkstar user-43=eatspam user-44=dhyana user-45=nscdp user-46=putterfc user-47=leftie user-48=foods user-49=health2045
Sep 11 08:09:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=fortunaz user-51=lkpier user-52=donnychicago user-53=firstre5 user-54=steakbridieme user-55=philmcph user-56=ctedorgu user-57=isleofwi user-58=smrszyqg user-59=nomistakes user-60=hidden user-61=barbersh user-62=tigerlet user-63=cathski user-64=cambria1 user-65=reliable user-66=ninejimm user-67=cwsocial user-68=paulmca1 user-69=howardon user-70=pugwash user-71=hirefootballgame user-72=eugincou user-73=courseme user-74=ultbcrra user-75=seftvta user-76=jonhartl user-77=firstres user-78=coursemc user-79=opaiscyx user-80=clarkass user-81=firstrel user-82=costestimatorco user-83=firstred user-84=highlegh user-85=southlon user-86=gilpin user-87=milloyco user-88=elecleis user-89=putterfi user-90=hubmaster user-91=fetch user-92=carsinyo user-93=accooper user-94=ianrayne user-95=connectedshoppin user-96=thqkgnbz user-97=nstriton user-98=brighto1 user-99=vivienn1 user-100=firstre2 user-101=oneoarco user-102=battlere
Sep 11 08:09:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=newstoda user-105=ggaaorgu user-106=belle user-107=bemadonn user-108=skyfirec user-109=alexadmin user-110=innovat1 user-111=stuartge user-112=askhform user-113=nativene user-114=markward user-115=booff user-116=foundation user-117=vantagep user-118=connect9 user-119=athenare user-120=lbscrmod user-121=maflemin user-122=ulsukarm user-123=jarvisin user-124=spectrum user-125=theblack user-126=hodgesonweb user-127=agproduc user-128=still user-129=stephani user-130=leereyn1 user-131=brmrjxl user-132=lakesan1 user-133=strathar user-134=atestord user-135=sarafoundation user-136=wilsonsw user-137=megacards user-138=musorguk user-139=martsblo user-140=dickemery123 user-141=ptkxhsbt user-142=hhdugcor user-143=lbhyisi user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 08:09:44 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 08:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:45 nativespace-cdp sudo[518571]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 08:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:46 nativespace-cdp sudo[518579]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Qwq3UPloUxTGr543.~
Sep 11 08:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:46 nativespace-cdp sudo[518582]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Qwq3UPloUxTGr543.~'
Sep 11 08:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:46 nativespace-cdp sudo[518585]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Qwq3UPloUxTGr543.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 08:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:46 nativespace-cdp sudo[518589]: pam_unix(sudo:session): session closed for user root
Sep 11 08:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 08:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:09:46 nativespace-cdp sudo[518592]: pam_unix(sudo:session): session closed for user root
Sep 11 08:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 08:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 08:10:21 nativespace-cdp sudo[518894]: pam_unix(sudo:session): session closed for user root
Sep 11 08:10:28 nativespace-cdp sshd[518910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.117.177.103  user=root
Sep 11 08:10:28 nativespace-cdp sshd[518910]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 08:10:30 nativespace-cdp sshd[518910]: Failed password for root from 45.117.177.103 port 49190 ssh2
Sep 11 08:10:31 nativespace-cdp sshd[518910]: Received disconnect from 45.117.177.103 port 49190:11: Bye Bye [preauth]
Sep 11 08:10:31 nativespace-cdp sshd[518910]: Disconnected from 45.117.177.103 port 49190 [preauth]
Sep 11 08:11:35 nativespace-cdp sshd[519350]: Connection closed by 159.100.136.21 port 34708 [preauth]
Sep 11 08:11:54 nativespace-cdp sshd[519455]: Invalid user nikita from 81.145.49.186 port 55209
Sep 11 08:11:54 nativespace-cdp sshd[519455]: input_userauth_request: invalid user nikita [preauth]
Sep 11 08:11:54 nativespace-cdp sshd[519455]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 08:11:54 nativespace-cdp sshd[519455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.145.49.186
Sep 11 08:11:56 nativespace-cdp sshd[519455]: Failed password for invalid user nikita from 81.145.49.186 port 55209 ssh2
Sep 11 08:12:00 nativespace-cdp sshd[519455]: Received disconnect from 81.145.49.186 port 55209:11: Bye Bye [preauth]
Sep 11 08:12:00 nativespace-cdp sshd[519455]: Disconnected from 81.145.49.186 port 55209 [preauth]
Sep 11 08:12:45 nativespace-cdp sshd[519586]: Invalid user admin from 104.131.67.146 port 46542
Sep 11 08:12:45 nativespace-cdp sshd[519586]: input_userauth_request: invalid user admin [preauth]
Sep 11 08:12:45 nativespace-cdp sshd[519586]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 08:12:45 nativespace-cdp sshd[519586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.67.146
Sep 11 08:12:47 nativespace-cdp sshd[519586]: Failed password for invalid user admin from 104.131.67.146 port 46542 ssh2
Sep 11 08:12:47 nativespace-cdp sshd[519586]: Received disconnect from 104.131.67.146 port 46542:11: Bye Bye [preauth]
Sep 11 08:12:47 nativespace-cdp sshd[519586]: Disconnected from 104.131.67.146 port 46542 [preauth]
Sep 11 08:12:55 nativespace-cdp sshd[519614]: Invalid user mini from 45.117.177.103 port 33156
Sep 11 08:12:55 nativespace-cdp sshd[519614]: input_userauth_request: invalid user mini [preauth]
Sep 11 08:12:55 nativespace-cdp sshd[519614]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 08:12:55 nativespace-cdp sshd[519614]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.117.177.103
Sep 11 08:12:57 nativespace-cdp sshd[519614]: Failed password for invalid user mini from 45.117.177.103 port 33156 ssh2
Sep 11 08:12:59 nativespace-cdp sshd[519614]: Received disconnect from 45.117.177.103 port 33156:11: Bye Bye [preauth]
Sep 11 08:12:59 nativespace-cdp sshd[519614]: Disconnected from 45.117.177.103 port 33156 [preauth]
Sep 11 08:13:13 nativespace-cdp sshd[519680]: Invalid user redash from 81.145.49.186 port 63453
Sep 11 08:13:13 nativespace-cdp sshd[519680]: input_userauth_request: invalid user redash [preauth]
Sep 11 08:13:13 nativespace-cdp sshd[519680]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 08:13:13 nativespace-cdp sshd[519680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.145.49.186
Sep 11 08:13:15 nativespace-cdp sshd[519680]: Failed password for invalid user redash from 81.145.49.186 port 63453 ssh2
Sep 11 08:13:15 nativespace-cdp sshd[519680]: Received disconnect from 81.145.49.186 port 63453:11: Bye Bye [preauth]
Sep 11 08:13:15 nativespace-cdp sshd[519680]: Disconnected from 81.145.49.186 port 63453 [preauth]
Sep 11 08:13:25 nativespace-cdp sshd[519711]: Invalid user emilia from 104.131.67.146 port 40246
Sep 11 08:13:25 nativespace-cdp sshd[519711]: input_userauth_request: invalid user emilia [preauth]
Sep 11 08:13:25 nativespace-cdp sshd[519711]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 08:13:25 nativespace-cdp sshd[519711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.67.146
Sep 11 08:13:27 nativespace-cdp sshd[519711]: Failed password for invalid user emilia from 104.131.67.146 port 40246 ssh2
Sep 11 08:13:28 nativespace-cdp sshd[519711]: Received disconnect from 104.131.67.146 port 40246:11: Bye Bye [preauth]
Sep 11 08:13:28 nativespace-cdp sshd[519711]: Disconnected from 104.131.67.146 port 40246 [preauth]
Sep 11 08:13:46 nativespace-cdp sshd[519800]: Invalid user user21 from 220.80.223.144 port 55020
Sep 11 08:13:46 nativespace-cdp sshd[519800]: input_userauth_request: invalid user user21 [preauth]
Sep 11 08:13:46 nativespace-cdp sshd[519800]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 08:13:46 nativespace-cdp sshd[519800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.80.223.144
Sep 11 08:13:48 nativespace-cdp sshd[519800]: Failed password for invalid user user21 from 220.80.223.144 port 55020 ssh2
Sep 11 08:13:48 nativespace-cdp sshd[519800]: Received disconnect from 220.80.223.144 port 55020:11: Bye Bye [preauth]
Sep 11 08:13:48 nativespace-cdp sshd[519800]: Disconnected from 220.80.223.144 port 55020 [preauth]
Sep 11 08:13:51 nativespace-cdp sshd[519966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.117.177.103  user=root
Sep 11 08:13:51 nativespace-cdp sshd[519966]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 08:13:52 nativespace-cdp sshd[520075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.145.49.186  user=root
Sep 11 08:13:52 nativespace-cdp sshd[520075]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 08:13:52 nativespace-cdp sshd[519966]: Failed password for root from 45.117.177.103 port 49708 ssh2
Sep 11 08:13:53 nativespace-cdp sshd[519966]: Received disconnect from 45.117.177.103 port 49708:11: Bye Bye [preauth]
Sep 11 08:13:53 nativespace-cdp sshd[519966]: Disconnected from 45.117.177.103 port 49708 [preauth]
Sep 11 08:13:54 nativespace-cdp sshd[520075]: Failed password for root from 81.145.49.186 port 6080 ssh2
Sep 11 08:13:54 nativespace-cdp sshd[520075]: Received disconnect from 81.145.49.186 port 6080:11: Bye Bye [preauth]
Sep 11 08:13:54 nativespace-cdp sshd[520075]: Disconnected from 81.145.49.186 port 6080 [preauth]
Sep 11 08:14:44 nativespace-cdp sshd[520280]: Connection closed by 220.80.223.144 port 46750 [preauth]
Sep 11 08:15:25 nativespace-cdp sshd[520591]: Invalid user csgoserver from 220.80.223.144 port 38164
Sep 11 08:15:25 nativespace-cdp sshd[520591]: input_userauth_request: invalid user csgoserver [preauth]
Sep 11 08:15:25 nativespace-cdp sshd[520591]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 08:15:25 nativespace-cdp sshd[520591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.80.223.144
Sep 11 08:15:26 nativespace-cdp sshd[520591]: Failed password for invalid user csgoserver from 220.80.223.144 port 38164 ssh2
Sep 11 08:15:26 nativespace-cdp sshd[520591]: Received disconnect from 220.80.223.144 port 38164:11: Bye Bye [preauth]
Sep 11 08:15:26 nativespace-cdp sshd[520591]: Disconnected from 220.80.223.144 port 38164 [preauth]
Sep 11 08:16:10 nativespace-cdp sshd[520787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.80.223.144  user=root
Sep 11 08:16:10 nativespace-cdp sshd[520787]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 08:16:12 nativespace-cdp sshd[520787]: Failed password for root from 220.80.223.144 port 57540 ssh2
Sep 11 08:16:17 nativespace-cdp sshd[520787]: Received disconnect from 220.80.223.144 port 57540:11: Bye Bye [preauth]
Sep 11 08:16:17 nativespace-cdp sshd[520787]: Disconnected from 220.80.223.144 port 57540 [preauth]
Sep 11 08:16:33 nativespace-cdp sshd[520875]: Connection closed by 159.100.136.21 port 44518 [preauth]
Sep 11 08:21:33 nativespace-cdp sshd[521948]: Connection closed by 159.100.136.21 port 53460 [preauth]
Sep 11 08:26:33 nativespace-cdp sshd[523599]: Connection closed by 159.100.136.21 port 34424 [preauth]
Sep 11 08:31:33 nativespace-cdp sshd[524757]: Connection closed by 159.100.136.21 port 43582 [preauth]
Sep 11 08:36:34 nativespace-cdp sshd[526038]: Connection closed by 159.100.136.21 port 52852 [preauth]
Sep 11 08:41:35 nativespace-cdp sshd[527151]: Connection closed by 159.100.136.21 port 33182 [preauth]
Sep 11 08:46:36 nativespace-cdp sshd[528444]: Connection closed by 159.100.136.21 port 43020 [preauth]
Sep 11 08:51:34 nativespace-cdp sshd[529733]: Connection closed by 159.100.136.21 port 52532 [preauth]
Sep 11 08:56:33 nativespace-cdp sshd[531301]: Connection closed by 159.100.136.21 port 34434 [preauth]
Sep 11 09:01:34 nativespace-cdp sshd[532948]: Connection closed by 159.100.136.21 port 44192 [preauth]
Sep 11 09:06:33 nativespace-cdp sshd[534368]: Connection closed by 159.100.136.21 port 53934 [preauth]
Sep 11 09:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 09:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:35 nativespace-cdp sudo[535006]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 09:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:35 nativespace-cdp sudo[535010]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 09:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:37 nativespace-cdp sudo[535015]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 09:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:37 nativespace-cdp sudo[535023]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 09:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:40 nativespace-cdp sudo[535030]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:40 nativespace-cdp sudo[535050]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:40 nativespace-cdp sudo[535055]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:40 nativespace-cdp sudo[535060]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:40 nativespace-cdp sudo[535065]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:40 nativespace-cdp sudo[535071]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 09:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:40 nativespace-cdp sudo[535076]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 09:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:42 nativespace-cdp sudo[535091]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 09:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:43 nativespace-cdp sudo[535099]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=connectedshoppin user-2=thqkgnbz user-3=accooper user-4=ianrayne user-5=putterfi user-6=hubmaster user-7=carsinyo user-8=fetch user-9=gilpin user-10=milloyco user-11=elecleis user-12=firstred user-13=southlon user-14=highlegh user-15=firstrel user-16=clarkass user-17=costestimatorco user-18=opaiscyx user-19=coursemc user-20=jonhartl user-21=seftvta user-22=ultbcrra user-23=firstres user-24=nativene user-25=innovat1 user-26=stuartge user-27=askhform user-28=alexadmin user-29=skyfirec user-30=belle user-31=ggaaorgu user-32=newstoda user-33=bemadonn user-34=bedfords user-35=firstre2 user-36=vivienn1 user-37=battlere user-38=oneoarco user-39=brighto1 user-40=nstriton user-41=stephani user-42=leereyn1 user-43=still user-44=agproduc user-45=spectrum user-46=theblack user-47=hodgesonweb
Sep 11 09:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=jarvisin user-49=ulsukarm user-50=athenare user-51=connect9 user-52=vantagep user-53=maflemin user-54=lbscrmod user-55=markward user-56=booff user-57=foundation user-58=magichat user-59=lbhyisi user-60=hhdugcor user-61=dickemery123 user-62=ptkxhsbt user-63=martsblo user-64=musorguk user-65=megacards user-66=wilsonsw user-67=strathar user-68=sarafoundation user-69=atestord user-70=lakesan1 user-71=brmrjxl user-72=romaldki user-73=hodgsonmail user-74=ranxterc user-75=outdoorc user-76=branko user-77=onlycont user-78=attlebor user-79=lucy user-80=nbhavers user-81=careers user-82=david user-83=chrisdal user-84=mcdermos user-85=jennimil user-86=tomandle user-87=design user-88=ladburyp user-89=stagingerris user-90=dancinggardener user-91=kategilpin user-92=cath user-93=sketchy user-94=havantho user-95=nvihkvu user-96=tstardom user-97=oubpgvbx user-98=what user-99=bakery user-100=sosevalu user-101=crrtipdl
Sep 11 09:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=boldover user-103=nove user-104=dhyana user-105=beauty user-106=eatspam user-107=darkstar user-108=nsceres user-109=burydropin user-110=fawcettd user-111=steve user-112=bwppodcast user-113=zebrapho user-114=asandcoc user-115=sibtoncc user-116=eugincou user-117=courseme user-118=hirefootballgame user-119=paulmca1 user-120=pugwash user-121=howardon user-122=cwsocial user-123=cambria1 user-124=cathski user-125=ninejimm user-126=reliable user-127=hidden user-128=nomistakes user-129=tigerlet user-130=barbersh user-131=smrszyqg user-132=isleofwi user-133=lkpier user-134=ctedorgu user-135=philmcph user-136=firstre5 user-137=donnychicago user-138=steakbridieme user-139=putterfc user-140=nscdp user-141=health2045 user-142=fortunaz user-143=foods user-144=leftie feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 09:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 09:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:44 nativespace-cdp sudo[535106]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 09:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:44 nativespace-cdp sudo[535116]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ebcbAy29OMC9iszm.~
Sep 11 09:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:45 nativespace-cdp sudo[535122]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ebcbAy29OMC9iszm.~'
Sep 11 09:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:45 nativespace-cdp sudo[535126]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ebcbAy29OMC9iszm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 09:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:45 nativespace-cdp sudo[535132]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 09:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:45 nativespace-cdp sudo[535137]: pam_unix(sudo:session): session closed for user root
Sep 11 09:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 09:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 09:09:57 nativespace-cdp sudo[535197]: pam_unix(sudo:session): session closed for user root
Sep 11 09:11:33 nativespace-cdp sshd[535816]: Connection closed by 159.100.136.21 port 35726 [preauth]
Sep 11 09:16:33 nativespace-cdp sshd[537283]: Connection closed by 159.100.136.21 port 45898 [preauth]
Sep 11 09:21:33 nativespace-cdp sshd[538914]: Connection closed by 159.100.136.21 port 55646 [preauth]
Sep 11 09:26:37 nativespace-cdp sshd[540791]: Connection closed by 159.100.136.21 port 37006 [preauth]
Sep 11 09:31:33 nativespace-cdp sshd[542242]: Connection closed by 159.100.136.21 port 46618 [preauth]
Sep 11 09:36:34 nativespace-cdp sshd[543486]: Connection closed by 159.100.136.21 port 56176 [preauth]
Sep 11 09:41:33 nativespace-cdp sshd[544992]: Connection closed by 159.100.136.21 port 36184 [preauth]
Sep 11 09:46:33 nativespace-cdp sshd[546463]: Connection closed by 159.100.136.21 port 45584 [preauth]
Sep 11 09:51:34 nativespace-cdp sshd[547860]: Connection closed by 159.100.136.21 port 53974 [preauth]
Sep 11 09:56:36 nativespace-cdp sshd[549189]: Connection closed by 159.100.136.21 port 34514 [preauth]
Sep 11 10:01:36 nativespace-cdp sshd[551009]: Connection closed by 159.100.136.21 port 43480 [preauth]
Sep 11 10:06:33 nativespace-cdp sshd[552709]: Connection closed by 159.100.136.21 port 52292 [preauth]
Sep 11 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:27 nativespace-cdp sudo[553310]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:27 nativespace-cdp sudo[553315]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 10:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:29 nativespace-cdp sudo[553320]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 10:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:29 nativespace-cdp sudo[553339]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 10:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:33 nativespace-cdp sudo[553346]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 10:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:33 nativespace-cdp sudo[553371]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 10:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:34 nativespace-cdp sudo[553376]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 10:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:34 nativespace-cdp sudo[553380]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 10:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:34 nativespace-cdp sudo[553385]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 10:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:34 nativespace-cdp sudo[553391]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 10:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:34 nativespace-cdp sudo[553396]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 10:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:41 nativespace-cdp sudo[553426]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 10:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:42 nativespace-cdp sudo[553432]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=cwsocial user-2=pugwash user-3=howardon user-4=paulmca1 user-5=ninejimm user-6=reliable user-7=cambria1 user-8=cathski user-9=courseme user-10=eugincou user-11=hirefootballgame user-12=firstre5 user-13=steakbridieme user-14=donnychicago user-15=ctedorgu user-16=philmcph user-17=lkpier user-18=foods user-19=leftie user-20=fortunaz user-21=health2045 user-22=nscdp user-23=putterfc user-24=tigerlet user-25=barbersh user-26=nomistakes user-27=hidden user-28=smrszyqg user-29=isleofwi user-30=nsceres user-31=fawcettd user-32=burydropin user-33=dhyana user-34=darkstar user-35=eatspam user-36=beauty user-37=sibtoncc user-38=asandcoc user-39=steve user-40=zebrapho user-41=bwppodcast user-42=nvihkvu user-43=havantho user-44=sketchy user-45=cath user-46=what user-47=tstardom user-48=oubpgvbx user-49=design
Sep 11 10:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=kategilpin user-51=dancinggardener user-52=stagingerris user-53=ladburyp user-54=boldover user-55=nove user-56=crrtipdl user-57=sosevalu user-58=bakery user-59=onlycont user-60=lucy user-61=attlebor user-62=romaldki user-63=branko user-64=outdoorc user-65=ranxterc user-66=hodgsonmail user-67=jennimil user-68=tomandle user-69=david user-70=nbhavers user-71=careers user-72=mcdermos user-73=chrisdal user-74=ptkxhsbt user-75=dickemery123 user-76=martsblo user-77=magichat user-78=hhdugcor user-79=lbhyisi user-80=atestord user-81=sarafoundation user-82=strathar user-83=lakesan1 user-84=brmrjxl user-85=megacards user-86=musorguk user-87=wilsonsw user-88=hodgesonweb user-89=theblack user-90=spectrum user-91=jarvisin user-92=leereyn1 user-93=stephani user-94=agproduc user-95=still user-96=lbscrmod user-97=maflemin user-98=vantagep user-99=athenare user-100=connect9 user-101=booff user-102=foundation
Sep 11 10:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=markward user-104=ulsukarm user-105=alexadmin user-106=skyfirec user-107=nativene user-108=stuartge user-109=askhform user-110=innovat1 user-111=oneoarco user-112=battlere user-113=vivienn1 user-114=firstre2 user-115=nstriton user-116=brighto1 user-117=bemadonn user-118=newstoda user-119=belle user-120=ggaaorgu user-121=bedfords user-122=fetch user-123=carsinyo user-124=putterfi user-125=hubmaster user-126=elecleis user-127=gilpin user-128=milloyco user-129=thqkgnbz user-130=connectedshoppin user-131=ianrayne user-132=accooper user-133=opaiscyx user-134=coursemc user-135=firstres user-136=ultbcrra user-137=jonhartl user-138=seftvta user-139=highlegh user-140=southlon user-141=firstred user-142=costestimatorco user-143=firstrel user-144=clarkass feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 10:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 10:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:43 nativespace-cdp sudo[553439]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 10:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:44 nativespace-cdp sudo[553447]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-93r9Ah7JwNo5mXQp.~
Sep 11 10:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:44 nativespace-cdp sudo[553452]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-93r9Ah7JwNo5mXQp.~'
Sep 11 10:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:44 nativespace-cdp sudo[553456]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-93r9Ah7JwNo5mXQp.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 10:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:44 nativespace-cdp sudo[553463]: pam_unix(sudo:session): session closed for user root
Sep 11 10:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 10:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:09:44 nativespace-cdp sudo[553468]: pam_unix(sudo:session): session closed for user root
Sep 11 10:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 10:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 10:10:02 nativespace-cdp sudo[553558]: pam_unix(sudo:session): session closed for user root
Sep 11 10:11:36 nativespace-cdp sshd[554272]: Connection closed by 159.100.136.21 port 33434 [preauth]
Sep 11 10:14:16 nativespace-cdp sshd[554892]: Invalid user postgres from 84.54.64.50 port 33224
Sep 11 10:14:16 nativespace-cdp sshd[554892]: input_userauth_request: invalid user postgres [preauth]
Sep 11 10:14:16 nativespace-cdp sshd[554892]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 10:14:16 nativespace-cdp sshd[554892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.54.64.50
Sep 11 10:14:18 nativespace-cdp sshd[554892]: Failed password for invalid user postgres from 84.54.64.50 port 33224 ssh2
Sep 11 10:14:24 nativespace-cdp sshd[554892]: Received disconnect from 84.54.64.50 port 33224:11: Bye Bye [preauth]
Sep 11 10:14:24 nativespace-cdp sshd[554892]: Disconnected from 84.54.64.50 port 33224 [preauth]
Sep 11 10:15:47 nativespace-cdp sshd[555446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.154.162.19  user=root
Sep 11 10:15:47 nativespace-cdp sshd[555446]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 10:15:49 nativespace-cdp sshd[555446]: Failed password for root from 122.154.162.19 port 60654 ssh2
Sep 11 10:15:51 nativespace-cdp sshd[555446]: Received disconnect from 122.154.162.19 port 60654:11: Bye Bye [preauth]
Sep 11 10:15:51 nativespace-cdp sshd[555446]: Disconnected from 122.154.162.19 port 60654 [preauth]
Sep 11 10:16:35 nativespace-cdp sshd[555974]: Connection closed by 159.100.136.21 port 42754 [preauth]
Sep 11 10:18:26 nativespace-cdp sshd[556332]: Invalid user ftpuser from 84.54.64.50 port 55772
Sep 11 10:18:26 nativespace-cdp sshd[556332]: input_userauth_request: invalid user ftpuser [preauth]
Sep 11 10:18:26 nativespace-cdp sshd[556332]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 10:18:26 nativespace-cdp sshd[556332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.54.64.50
Sep 11 10:18:28 nativespace-cdp sshd[556332]: Failed password for invalid user ftpuser from 84.54.64.50 port 55772 ssh2
Sep 11 10:18:28 nativespace-cdp sshd[556332]: Received disconnect from 84.54.64.50 port 55772:11: Bye Bye [preauth]
Sep 11 10:18:28 nativespace-cdp sshd[556332]: Disconnected from 84.54.64.50 port 55772 [preauth]
Sep 11 10:18:53 nativespace-cdp sshd[556430]: Invalid user syncthing from 122.154.162.19 port 59364
Sep 11 10:18:53 nativespace-cdp sshd[556430]: input_userauth_request: invalid user syncthing [preauth]
Sep 11 10:18:53 nativespace-cdp sshd[556430]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 10:18:53 nativespace-cdp sshd[556430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.154.162.19
Sep 11 10:18:55 nativespace-cdp sshd[556430]: Failed password for invalid user syncthing from 122.154.162.19 port 59364 ssh2
Sep 11 10:18:57 nativespace-cdp sshd[556430]: Received disconnect from 122.154.162.19 port 59364:11: Bye Bye [preauth]
Sep 11 10:18:57 nativespace-cdp sshd[556430]: Disconnected from 122.154.162.19 port 59364 [preauth]
Sep 11 10:19:14 nativespace-cdp sshd[556504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.54.64.50  user=root
Sep 11 10:19:14 nativespace-cdp sshd[556504]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 10:19:16 nativespace-cdp sshd[556504]: Failed password for root from 84.54.64.50 port 60628 ssh2
Sep 11 10:19:16 nativespace-cdp sshd[556504]: Received disconnect from 84.54.64.50 port 60628:11: Bye Bye [preauth]
Sep 11 10:19:16 nativespace-cdp sshd[556504]: Disconnected from 84.54.64.50 port 60628 [preauth]
Sep 11 10:19:44 nativespace-cdp sshd[556610]: Invalid user andy from 122.154.162.19 port 44514
Sep 11 10:19:44 nativespace-cdp sshd[556610]: input_userauth_request: invalid user andy [preauth]
Sep 11 10:19:44 nativespace-cdp sshd[556610]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 10:19:44 nativespace-cdp sshd[556610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.154.162.19
Sep 11 10:19:45 nativespace-cdp sshd[556610]: Failed password for invalid user andy from 122.154.162.19 port 44514 ssh2
Sep 11 10:19:46 nativespace-cdp sshd[556610]: Received disconnect from 122.154.162.19 port 44514:11: Bye Bye [preauth]
Sep 11 10:19:46 nativespace-cdp sshd[556610]: Disconnected from 122.154.162.19 port 44514 [preauth]
Sep 11 10:21:35 nativespace-cdp sshd[557255]: Connection closed by 159.100.136.21 port 51710 [preauth]
Sep 11 10:26:36 nativespace-cdp sshd[558851]: Connection closed by 159.100.136.21 port 60724 [preauth]
Sep 11 10:31:33 nativespace-cdp sshd[560511]: Connection closed by 159.100.136.21 port 41610 [preauth]
Sep 11 10:36:33 nativespace-cdp sshd[561817]: Connection closed by 159.100.136.21 port 50682 [preauth]
Sep 11 10:41:33 nativespace-cdp sshd[563156]: Connection closed by 159.100.136.21 port 59992 [preauth]
Sep 11 10:46:36 nativespace-cdp sshd[564905]: Connection closed by 159.100.136.21 port 41322 [preauth]
Sep 11 10:51:35 nativespace-cdp sshd[566333]: Connection closed by 159.100.136.21 port 50768 [preauth]
Sep 11 10:56:33 nativespace-cdp sshd[567871]: Connection closed by 159.100.136.21 port 59168 [preauth]
Sep 11 11:01:33 nativespace-cdp sshd[569610]: Connection closed by 159.100.136.21 port 39910 [preauth]
Sep 11 11:06:33 nativespace-cdp sshd[571273]: Connection closed by 159.100.136.21 port 48976 [preauth]
Sep 11 11:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 11:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:27 nativespace-cdp sudo[571914]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 11:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:27 nativespace-cdp sudo[571918]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 11:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:29 nativespace-cdp sudo[571923]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 11:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:29 nativespace-cdp sudo[571935]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 11:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:32 nativespace-cdp sudo[571941]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:32 nativespace-cdp sudo[571957]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:32 nativespace-cdp sudo[571962]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:32 nativespace-cdp sudo[571966]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:32 nativespace-cdp sudo[571971]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:32 nativespace-cdp sudo[571977]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 11:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:33 nativespace-cdp sudo[571982]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:34 nativespace-cdp sudo[571995]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:35 nativespace-cdp sudo[572004]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=megacards user-2=musorguk user-3=wilsonsw user-4=atestord user-5=sarafoundation user-6=strathar user-7=brmrjxl user-8=lakesan1 user-9=magichat user-10=hhdugcor user-11=lbhyisi user-12=ptkxhsbt user-13=dickemery123 user-14=martsblo user-15=ulsukarm user-16=lbscrmod user-17=maflemin user-18=vantagep user-19=connect9 user-20=athenare user-21=booff user-22=foundation user-23=markward user-24=leereyn1 user-25=stephani user-26=agproduc user-27=still user-28=hodgesonweb user-29=theblack user-30=spectrum user-31=jarvisin user-32=bemadonn user-33=newstoda user-34=belle user-35=ggaaorgu user-36=bedfords user-37=oneoarco user-38=battlere user-39=vivienn1 user-40=firstre2 user-41=nstriton user-42=brighto1 user-43=nativene user-44=askhform user-45=stuartge user-46=innovat1 user-47=skyfirec user-48=alexadmin
Sep 11 11:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=highlegh user-50=southlon user-51=firstred user-52=costestimatorco user-53=firstrel user-54=clarkass user-55=opaiscyx user-56=coursemc user-57=firstres user-58=ultbcrra user-59=jonhartl user-60=seftvta user-61=thqkgnbz user-62=connectedshoppin user-63=ianrayne user-64=accooper user-65=fetch user-66=carsinyo user-67=putterfi user-68=hubmaster user-69=elecleis user-70=milloyco user-71=gilpin user-72=tigerlet user-73=barbersh user-74=nomistakes user-75=hidden user-76=smrszyqg user-77=isleofwi user-78=firstre5 user-79=donnychicago user-80=steakbridieme user-81=philmcph user-82=ctedorgu user-83=lkpier user-84=leftie user-85=foods user-86=health2045 user-87=fortunaz user-88=nscdp user-89=putterfc user-90=courseme user-91=eugincou user-92=hirefootballgame user-93=cwsocial user-94=pugwash user-95=howardon user-96=paulmca1 user-97=ninejimm user-98=reliable user-99=cathski user-100=cambria1 user-101=steve
Sep 11 11:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=zebrapho user-103=bwppodcast user-104=sibtoncc user-105=asandcoc user-106=dhyana user-107=darkstar user-108=eatspam user-109=beauty user-110=nsceres user-111=fawcettd user-112=burydropin user-113=crrtipdl user-114=sosevalu user-115=bakery user-116=boldover user-117=nove user-118=design user-119=kategilpin user-120=dancinggardener user-121=stagingerris user-122=ladburyp user-123=nvihkvu user-124=havantho user-125=sketchy user-126=cath user-127=what user-128=oubpgvbx user-129=tstardom user-130=david user-131=nbhavers user-132=careers user-133=mcdermos user-134=chrisdal user-135=jennimil user-136=tomandle user-137=romaldki user-138=branko user-139=outdoorc user-140=ranxterc user-141=hodgsonmail user-142=onlycont user-143=lucy user-144=attlebor feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 11:09:35 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:36 nativespace-cdp sudo[572011]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 11 11:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:38 nativespace-cdp sudo[572032]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep 11 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 11 11:09:38 nativespace-cdp sudo[572037]: pam_unix(sudo:session): session closed for user onlycont
Sep 11 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 11 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:39 nativespace-cdp sudo[572051]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 11 11:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 11:09:39 nativespace-cdp sudo[572056]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 11:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 11 11:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:41 nativespace-cdp sudo[572082]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep 11 11:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 11 11:09:41 nativespace-cdp sudo[572090]: pam_unix(sudo:session): session closed for user lkpier
Sep 11 11:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 11 11:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:42 nativespace-cdp sudo[572105]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep 11 11:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 11 11:09:42 nativespace-cdp sudo[572114]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 11 11:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 11 11:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 11 11:09:42 nativespace-cdp sudo[572128]: pam_unix(sudo:session): session closed for user oneoarco
Sep 11 11:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 11 11:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:43 nativespace-cdp sudo[572139]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep 11 11:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 11 11:09:43 nativespace-cdp sudo[572145]: pam_unix(sudo:session): session closed for user fortunaz
Sep 11 11:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep 11 11:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:43 nativespace-cdp sudo[572158]: pam_unix(sudo:session): session closed for user root
Sep 11 11:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 11:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:09:43 nativespace-cdp sudo[572162]: pam_unix(sudo:session): session closed for user root
Sep 11 11:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep 11 11:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:10:02 nativespace-cdp sudo[573197]: pam_unix(sudo:session): session closed for user root
Sep 11 11:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep 11 11:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:10:02 nativespace-cdp sudo[573214]: pam_unix(sudo:session): session closed for user root
Sep 11 11:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 11:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:10:09 nativespace-cdp sudo[573267]: pam_unix(sudo:session): session closed for user root
Sep 11 11:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-CNexJWI2BoPRQLto.~
Sep 11 11:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:10:09 nativespace-cdp sudo[573270]: pam_unix(sudo:session): session closed for user root
Sep 11 11:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-CNexJWI2BoPRQLto.~'
Sep 11 11:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:10:09 nativespace-cdp sudo[573273]: pam_unix(sudo:session): session closed for user root
Sep 11 11:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-CNexJWI2BoPRQLto.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 11:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:10:09 nativespace-cdp sudo[573277]: pam_unix(sudo:session): session closed for user root
Sep 11 11:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 11:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:10:09 nativespace-cdp sudo[573280]: pam_unix(sudo:session): session closed for user root
Sep 11 11:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 11:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 11:10:11 nativespace-cdp sudo[573294]: pam_unix(sudo:session): session closed for user root
Sep 11 11:11:33 nativespace-cdp sshd[574053]: Connection closed by 159.100.136.21 port 57338 [preauth]
Sep 11 11:16:33 nativespace-cdp sshd[575780]: Connection closed by 159.100.136.21 port 38246 [preauth]
Sep 11 11:17:51 nativespace-cdp crond[575917]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 11 11:17:51 nativespace-cdp crond[575916]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 11 11:18:28 nativespace-cdp sshd[576098]: Accepted publickey for root from 185.67.178.249 port 39498 ssh2: RSA SHA256:KEtFTfDjAxzMWDlrWpkMCiEi4xCNzI/HgmmS90Zuo/g
Sep 11 11:18:31 nativespace-cdp sshd[576098]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep 11 11:18:46 nativespace-cdp polkitd[1948347]: Registered Authentication Agent for unix-process:576245:535860275 (system bus name :1.1194157 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Sep 11 11:19:12 nativespace-cdp polkitd[1948347]: Unregistered Authentication Agent for unix-process:576245:535860275 (system bus name :1.1194157, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Sep 11 11:19:12 nativespace-cdp polkitd[1948347]: Registered Authentication Agent for unix-process:576400:535862948 (system bus name :1.1194163 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Sep 11 11:21:33 nativespace-cdp sshd[577503]: Connection closed by 159.100.136.21 port 47744 [preauth]
Sep 11 11:22:46 nativespace-cdp polkitd[1948347]: Unregistered Authentication Agent for unix-process:576400:535862948 (system bus name :1.1194163, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Sep 11 11:26:33 nativespace-cdp sshd[579436]: Connection closed by 159.100.136.21 port 57196 [preauth]
Sep 11 11:30:26 nativespace-cdp sshd[576098]: Received disconnect from 185.67.178.249 port 39498:11: Normal Shutdown
Sep 11 11:30:26 nativespace-cdp sshd[576098]: Disconnected from 185.67.178.249 port 39498
Sep 11 11:30:26 nativespace-cdp sshd[576098]: pam_unix(sshd:session): session closed for user root
Sep 11 11:31:33 nativespace-cdp sshd[581465]: Connection closed by 159.100.136.21 port 38576 [preauth]
Sep 11 11:36:35 nativespace-cdp sshd[583031]: Connection closed by 159.100.136.21 port 47596 [preauth]
Sep 11 11:41:37 nativespace-cdp sshd[584669]: Connection closed by 159.100.136.21 port 56862 [preauth]
Sep 11 11:46:33 nativespace-cdp sshd[586647]: Connection closed by 159.100.136.21 port 38094 [preauth]
Sep 11 11:51:33 nativespace-cdp sshd[588400]: Connection closed by 159.100.136.21 port 46112 [preauth]
Sep 11 11:56:34 nativespace-cdp sshd[589847]: Connection closed by 159.100.136.21 port 55788 [preauth]
Sep 11 12:01:33 nativespace-cdp sshd[591554]: Connection closed by 159.100.136.21 port 36184 [preauth]
Sep 11 12:06:33 nativespace-cdp sshd[592773]: Connection closed by 159.100.136.21 port 45064 [preauth]
Sep 11 12:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 12:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:35 nativespace-cdp sudo[593457]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 12:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:35 nativespace-cdp sudo[593462]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:36 nativespace-cdp sudo[593467]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 12:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:36 nativespace-cdp sudo[593475]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 12:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:39 nativespace-cdp sudo[593482]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 12:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:39 nativespace-cdp sudo[593499]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 12:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:39 nativespace-cdp sudo[593505]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 12:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:39 nativespace-cdp sudo[593509]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 12:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:39 nativespace-cdp sudo[593514]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 12:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:39 nativespace-cdp sudo[593519]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 12:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:39 nativespace-cdp sudo[593528]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:42 nativespace-cdp sudo[593554]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:42 nativespace-cdp sudo[593560]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=brighto1 user-2=nstriton user-3=battlere user-4=oneoarco user-5=firstre2 user-6=vivienn1 user-7=bedfords user-8=bemadonn user-9=belle user-10=ggaaorgu user-11=newstoda user-12=alexadmin user-13=skyfirec user-14=stuartge user-15=askhform user-16=innovat1 user-17=nativene user-18=firstres user-19=seftvta user-20=jonhartl user-21=ultbcrra user-22=opaiscyx user-23=coursemc user-24=costestimatorco user-25=firstrel user-26=clarkass user-27=southlon user-28=highlegh user-29=firstred user-30=elecleis user-31=gilpin user-32=milloyco user-33=carsinyo user-34=fetch user-35=hubmaster user-36=putterfi user-37=ianrayne user-38=accooper user-39=thqkgnbz user-40=connectedshoppin user-41=lakesan1 user-42=brmrjxl user-43=sarafoundation user-44=atestord user-45=strathar user-46=wilsonsw user-47=musorguk
Sep 11 12:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=martsblo user-50=ptkxhsbt user-51=dickemery123 user-52=lbhyisi user-53=hhdugcor user-54=magichat user-55=markward user-56=booff user-57=foundation user-58=maflemin user-59=lbscrmod user-60=athenare user-61=connect9 user-62=vantagep user-63=ulsukarm user-64=jarvisin user-65=theblack user-66=hodgesonweb user-67=spectrum user-68=still user-69=agproduc user-70=leereyn1 user-71=stephani user-72=nove user-73=boldover user-74=sosevalu user-75=crrtipdl user-76=bakery user-77=what user-78=oubpgvbx user-79=tstardom user-80=nvihkvu user-81=cath user-82=sketchy user-83=havantho user-84=kategilpin user-85=ladburyp user-86=stagingerris user-87=dancinggardener user-88=design user-89=tomandle user-90=jennimil user-91=mcdermos user-92=chrisdal user-93=nbhavers user-94=careers user-95=david user-96=attlebor user-97=lucy user-98=onlycont user-99=branko user-100=ranxterc user-101=outdoorc
Sep 11 12:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hodgsonmail user-103=romaldki user-104=health2045 user-105=fortunaz user-106=leftie user-107=foods user-108=putterfc user-109=nscdp user-110=philmcph user-111=ctedorgu user-112=steakbridieme user-113=firstre5 user-114=donnychicago user-115=lkpier user-116=smrszyqg user-117=isleofwi user-118=tigerlet user-119=barbersh user-120=hidden user-121=nomistakes user-122=reliable user-123=ninejimm user-124=cathski user-125=cambria1 user-126=howardon user-127=paulmca1 user-128=pugwash user-129=cwsocial user-130=hirefootballgame user-131=courseme user-132=eugincou user-133=sibtoncc user-134=asandcoc user-135=zebrapho user-136=bwppodcast user-137=steve user-138=burydropin user-139=fawcettd user-140=nsceres user-141=eatspam user-142=darkstar user-143=beauty user-144=dhyana feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 11 12:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:44 nativespace-cdp sudo[593568]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:44 nativespace-cdp sudo[593578]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-LcsnS3SJZCxp6QiA.~
Sep 11 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:44 nativespace-cdp sudo[593583]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-LcsnS3SJZCxp6QiA.~'
Sep 11 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:44 nativespace-cdp sudo[593587]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-LcsnS3SJZCxp6QiA.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:44 nativespace-cdp sudo[593593]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 12:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:44 nativespace-cdp sudo[593598]: pam_unix(sudo:session): session closed for user root
Sep 11 12:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 12:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:09:53 nativespace-cdp sudo[593668]: pam_unix(sudo:session): session closed for user root
Sep 11 12:11:33 nativespace-cdp sshd[594437]: Connection closed by 159.100.136.21 port 54200 [preauth]
Sep 11 12:11:59 nativespace-cdp sshd[594512]: Invalid user xts from 20.204.98.63 port 40804
Sep 11 12:11:59 nativespace-cdp sshd[594512]: input_userauth_request: invalid user xts [preauth]
Sep 11 12:11:59 nativespace-cdp sshd[594512]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 12:11:59 nativespace-cdp sshd[594512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.204.98.63
Sep 11 12:12:01 nativespace-cdp sshd[594512]: Failed password for invalid user xts from 20.204.98.63 port 40804 ssh2
Sep 11 12:12:02 nativespace-cdp sshd[594512]: Received disconnect from 20.204.98.63 port 40804:11: Bye Bye [preauth]
Sep 11 12:12:02 nativespace-cdp sshd[594512]: Disconnected from 20.204.98.63 port 40804 [preauth]
Sep 11 12:13:00 nativespace-cdp sshd[594761]: Invalid user blog from 20.204.98.63 port 42088
Sep 11 12:13:00 nativespace-cdp sshd[594761]: input_userauth_request: invalid user blog [preauth]
Sep 11 12:13:00 nativespace-cdp sshd[594761]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 12:13:00 nativespace-cdp sshd[594761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.204.98.63
Sep 11 12:13:01 nativespace-cdp sshd[594761]: Failed password for invalid user blog from 20.204.98.63 port 42088 ssh2
Sep 11 12:13:04 nativespace-cdp sshd[594761]: Received disconnect from 20.204.98.63 port 42088:11: Bye Bye [preauth]
Sep 11 12:13:04 nativespace-cdp sshd[594761]: Disconnected from 20.204.98.63 port 42088 [preauth]
Sep 11 12:13:48 nativespace-cdp sshd[595011]: Invalid user anas from 20.204.98.63 port 40916
Sep 11 12:13:48 nativespace-cdp sshd[595011]: input_userauth_request: invalid user anas [preauth]
Sep 11 12:13:48 nativespace-cdp sshd[595011]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 12:13:48 nativespace-cdp sshd[595011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.204.98.63
Sep 11 12:13:49 nativespace-cdp sshd[595011]: Failed password for invalid user anas from 20.204.98.63 port 40916 ssh2
Sep 11 12:13:53 nativespace-cdp sshd[595011]: Received disconnect from 20.204.98.63 port 40916:11: Bye Bye [preauth]
Sep 11 12:13:53 nativespace-cdp sshd[595011]: Disconnected from 20.204.98.63 port 40916 [preauth]
Sep 11 12:16:34 nativespace-cdp sshd[596190]: Connection closed by 159.100.136.21 port 34898 [preauth]
Sep 11 12:21:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:09 nativespace-cdp sudo[597633]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:21:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:10 nativespace-cdp sudo[597643]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:21:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:10 nativespace-cdp sudo[597651]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=theblack user-3=hodgesonweb user-4=spectrum user-5=still user-6=agproduc user-7=leereyn1 user-8=stephani user-9=markward user-10=booff user-11=foundation user-12=maflemin user-13=lbscrmod user-14=athenare user-15=connect9 user-16=vantagep user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=lbhyisi user-22=hhdugcor user-23=magichat user-24=lakesan1 user-25=brmrjxl user-26=sarafoundation user-27=atestord user-28=strathar user-29=wilsonsw user-30=musorguk user-31=megacards user-32=elecleis user-33=gilpin user-34=milloyco user-35=carsinyo user-36=fetch user-37=hubmaster user-38=putterfi user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=seftvta user-45=jonhartl user-46=ultbcrra user-47=coursemc
Sep 11 12:21:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=opaiscyx user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=southlon user-53=highlegh user-54=firstred user-55=skyfirec user-56=alexadmin user-57=askhform user-58=stuartge user-59=innovat1 user-60=nativene user-61=brighto1 user-62=nstriton user-63=battlere user-64=oneoarco user-65=firstre2 user-66=vivienn1 user-67=bedfords user-68=bemadonn user-69=ggaaorgu user-70=belle user-71=newstoda user-72=burydropin user-73=fawcettd user-74=nsceres user-75=eatspam user-76=darkstar user-77=beauty user-78=dhyana user-79=sibtoncc user-80=asandcoc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=ninejimm user-85=reliable user-86=cathski user-87=cambria1 user-88=pugwash user-89=howardon user-90=paulmca1 user-91=cwsocial user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=fortunaz user-96=health2045 user-97=foods user-98=leftie user-99=putterfc user-100=nscdp user-101=ctedorgu
Sep 11 12:21:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=philmcph user-103=donnychicago user-104=firstre5 user-105=steakbridieme user-106=lkpier user-107=isleofwi user-108=smrszyqg user-109=tigerlet user-110=barbersh user-111=hidden user-112=nomistakes user-113=attlebor user-114=lucy user-115=onlycont user-116=branko user-117=hodgsonmail user-118=ranxterc user-119=outdoorc user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=nbhavers user-126=careers user-127=david user-128=what user-129=oubpgvbx user-130=tstardom user-131=nvihkvu user-132=cath user-133=sketchy user-134=havantho user-135=kategilpin user-136=ladburyp user-137=stagingerris user-138=dancinggardener user-139=design user-140=nove user-141=boldover user-142=sosevalu user-143=crrtipdl user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:21:10 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:21:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:11 nativespace-cdp sudo[597658]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery ResourceUsage get_usages --output=json
Sep 11 12:21:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:13 nativespace-cdp sudo[597664]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=database_prefix --output=json
Sep 11 12:21:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:13 nativespace-cdp sudo[597686]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery Mysql get_restrictions --output=json
Sep 11 12:21:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:13 nativespace-cdp sudo[597712]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:14 nativespace-cdp sudo[597692]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery Mysql list_databases --output=json
Sep 11 12:21:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:14 nativespace-cdp sudo[597724]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bakery
Sep 11 12:21:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:15 nativespace-cdp sudo[597740]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bakery ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bakery/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 11 12:21:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bakery by (uid=0)
Sep 11 12:21:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:18 nativespace-cdp sudo[597774]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:19 nativespace-cdp sudo[597748]: pam_unix(sudo:session): session closed for user bakery
Sep 11 12:21:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bakery ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bakery/public_html && /usr/local/bin/php -r 'echo implode('"'"','"'"', get_loaded_extensions());'
Sep 11 12:21:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bakery by (uid=0)
Sep 11 12:21:19 nativespace-cdp sudo[597785]: pam_unix(sudo:session): session closed for user bakery
Sep 11 12:21:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery PasswdStrength get_required_strength app=mysql --output=json
Sep 11 12:21:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:19 nativespace-cdp sudo[597793]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cpapi2 --user=bakery --input=json PasswdStrength get_password_strength --output=json
Sep 11 12:21:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:19 nativespace-cdp sudo[597799]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bakery ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bakery/public_html/
Sep 11 12:21:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bakery by (uid=0)
Sep 11 12:21:20 nativespace-cdp sudo[597806]: pam_unix(sudo:session): session closed for user bakery
Sep 11 12:21:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bakery ; COMMAND=/bin/cagefs_enter.proxied find /home/bakery/public_html/ -mindepth 1 -maxdepth 1 -printf %f\0
Sep 11 12:21:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bakery by (uid=0)
Sep 11 12:21:20 nativespace-cdp sudo[597811]: pam_unix(sudo:session): session closed for user bakery
Sep 11 12:21:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery Variables get_user_information --output=json
Sep 11 12:21:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:20 nativespace-cdp sudo[597824]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cpapi2 --user=bakery Locale get_user_locale --output=json
Sep 11 12:21:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:20 nativespace-cdp sudo[597830]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 12:21:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:21 nativespace-cdp sudo[597844]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:22 nativespace-cdp sudo[597858]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bakery
Sep 11 12:21:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:22 nativespace-cdp sudo[597868]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /home/bakery/public_html/.wp-toolkit-ignore
Sep 11 12:21:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:22 nativespace-cdp sudo[597887]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery Variables get_user_information --output=json
Sep 11 12:21:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:23 nativespace-cdp sudo[597894]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 11 12:21:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:23 nativespace-cdp sudo[597916]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bakery ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bakery/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 11 12:21:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bakery by (uid=0)
Sep 11 12:21:23 nativespace-cdp sudo[597921]: pam_unix(sudo:session): session closed for user bakery
Sep 11 12:21:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:24 nativespace-cdp sudo[597974]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:21:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:25 nativespace-cdp sudo[597985]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:21:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:25 nativespace-cdp sudo[597991]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=barbersh user-2=tigerlet user-3=hidden user-4=nomistakes user-5=isleofwi user-6=smrszyqg user-7=ctedorgu user-8=philmcph user-9=steakbridieme user-10=firstre5 user-11=donnychicago user-12=lkpier user-13=fortunaz user-14=health2045 user-15=foods user-16=leftie user-17=putterfc user-18=nscdp user-19=courseme user-20=eugincou user-21=hirefootballgame user-22=pugwash user-23=howardon user-24=paulmca1 user-25=cwsocial user-26=reliable user-27=ninejimm user-28=cathski user-29=cambria1 user-30=steve user-31=zebrapho user-32=bwppodcast user-33=sibtoncc user-34=asandcoc user-35=dhyana user-36=eatspam user-37=darkstar user-38=beauty user-39=nsceres user-40=burydropin user-41=fawcettd user-42=sosevalu user-43=crrtipdl user-44=bakery user-45=boldover user-46=nove user-47=design user-48=kategilpin
Sep 11 12:21:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ladburyp user-50=dancinggardener user-51=stagingerris user-52=nvihkvu user-53=sketchy user-54=cath user-55=havantho user-56=what user-57=oubpgvbx user-58=tstardom user-59=careers user-60=nbhavers user-61=david user-62=mcdermos user-63=chrisdal user-64=jennimil user-65=tomandle user-66=romaldki user-67=branko user-68=outdoorc user-69=ranxterc user-70=hodgsonmail user-71=onlycont user-72=attlebor user-73=lucy user-74=musorguk user-75=megacards user-76=wilsonsw user-77=sarafoundation user-78=atestord user-79=strathar user-80=lakesan1 user-81=brmrjxl user-82=magichat user-83=lbhyisi user-84=hhdugcor user-85=ptkxhsbt user-86=dickemery123 user-87=martsblo user-88=ulsukarm user-89=maflemin user-90=lbscrmod user-91=athenare user-92=connect9 user-93=vantagep user-94=foundation user-95=booff user-96=markward user-97=leereyn1 user-98=stephani user-99=still user-100=agproduc user-101=theblack user-102=hodgesonweb
Sep 11 12:21:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=spectrum user-104=jarvisin user-105=bemadonn user-106=ggaaorgu user-107=belle user-108=newstoda user-109=bedfords user-110=battlere user-111=oneoarco user-112=firstre2 user-113=vivienn1 user-114=brighto1 user-115=nstriton user-116=nativene user-117=askhform user-118=stuartge user-119=innovat1 user-120=skyfirec user-121=alexadmin user-122=southlon user-123=highlegh user-124=firstred user-125=costestimatorco user-126=firstrel user-127=clarkass user-128=coursemc user-129=opaiscyx user-130=firstres user-131=jonhartl user-132=seftvta user-133=ultbcrra user-134=thqkgnbz user-135=connectedshoppin user-136=ianrayne user-137=accooper user-138=carsinyo user-139=fetch user-140=hubmaster user-141=putterfi user-142=elecleis user-143=gilpin user-144=milloyco feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:21:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:21:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:26 nativespace-cdp sudo[598004]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:28 nativespace-cdp sudo[598158]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:21:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:29 nativespace-cdp sudo[598169]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:21:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:29 nativespace-cdp sudo[598175]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=foundation user-2=booff user-3=markward user-4=connect9 user-5=athenare user-6=vantagep user-7=maflemin user-8=lbscrmod user-9=ulsukarm user-10=jarvisin user-11=spectrum user-12=theblack user-13=hodgesonweb user-14=still user-15=agproduc user-16=stephani user-17=leereyn1 user-18=lakesan1 user-19=brmrjxl user-20=strathar user-21=sarafoundation user-22=atestord user-23=wilsonsw user-24=musorguk user-25=megacards user-26=martsblo user-27=dickemery123 user-28=ptkxhsbt user-29=lbhyisi user-30=hhdugcor user-31=magichat user-32=jonhartl user-33=seftvta user-34=ultbcrra user-35=firstres user-36=coursemc user-37=opaiscyx user-38=firstrel user-39=clarkass user-40=costestimatorco user-41=firstred user-42=southlon user-43=highlegh user-44=milloyco user-45=gilpin user-46=elecleis user-47=hubmaster
Sep 11 12:21:29 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=putterfi user-49=carsinyo user-50=fetch user-51=accooper user-52=ianrayne user-53=connectedshoppin user-54=thqkgnbz user-55=brighto1 user-56=nstriton user-57=firstre2 user-58=vivienn1 user-59=battlere user-60=oneoarco user-61=bedfords user-62=belle user-63=ggaaorgu user-64=newstoda user-65=bemadonn user-66=alexadmin user-67=skyfirec user-68=innovat1 user-69=askhform user-70=stuartge user-71=nativene user-72=sibtoncc user-73=asandcoc user-74=bwppodcast user-75=zebrapho user-76=steve user-77=burydropin user-78=fawcettd user-79=nsceres user-80=beauty user-81=eatspam user-82=darkstar user-83=dhyana user-84=putterfc user-85=nscdp user-86=fortunaz user-87=health2045 user-88=leftie user-89=foods user-90=lkpier user-91=philmcph user-92=ctedorgu user-93=firstre5 user-94=steakbridieme user-95=donnychicago user-96=isleofwi user-97=smrszyqg user-98=hidden user-99=nomistakes user-100=barbersh user-101=tigerlet
Sep 11 12:21:29 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=cathski user-103=cambria1 user-104=ninejimm user-105=reliable user-106=pugwash user-107=paulmca1 user-108=howardon user-109=cwsocial user-110=hirefootballgame user-111=eugincou user-112=courseme user-113=tomandle user-114=jennimil user-115=chrisdal user-116=mcdermos user-117=nbhavers user-118=careers user-119=david user-120=attlebor user-121=lucy user-122=onlycont user-123=outdoorc user-124=ranxterc user-125=hodgsonmail user-126=branko user-127=romaldki user-128=nove user-129=boldover user-130=bakery user-131=sosevalu user-132=crrtipdl user-133=oubpgvbx user-134=tstardom user-135=what user-136=cath user-137=sketchy user-138=havantho user-139=nvihkvu user-140=ladburyp user-141=dancinggardener user-142=stagingerris user-143=kategilpin user-144=design feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:21:29 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:21:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery DomainInfo single_domain_data domain=steakbridie.com return_https_redirect_status=1 --output=json
Sep 11 12:21:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:30 nativespace-cdp sudo[598189]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery DomainInfo single_domain_data domain=steakbridie.com return_https_redirect_status=1 --output=json
Sep 11 12:21:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:31 nativespace-cdp sudo[598214]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:31 nativespace-cdp sudo[598195]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery Mime list_redirects --output=json
Sep 11 12:21:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bakery Mime list_redirects --output=json
Sep 11 12:21:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:31 nativespace-cdp sudo[598233]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:31 nativespace-cdp sudo[598234]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:33 nativespace-cdp sshd[598267]: Connection closed by 159.100.136.21 port 43850 [preauth]
Sep 11 12:21:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:33 nativespace-cdp sudo[598289]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:21:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:34 nativespace-cdp sudo[598300]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:21:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:34 nativespace-cdp sudo[598306]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=dhyana user-2=beauty user-3=darkstar user-4=eatspam user-5=nsceres user-6=fawcettd user-7=burydropin user-8=steve user-9=bwppodcast user-10=zebrapho user-11=asandcoc user-12=sibtoncc user-13=eugincou user-14=courseme user-15=hirefootballgame user-16=cwsocial user-17=pugwash user-18=howardon user-19=paulmca1 user-20=cathski user-21=cambria1 user-22=ninejimm user-23=reliable user-24=nomistakes user-25=hidden user-26=tigerlet user-27=barbersh user-28=isleofwi user-29=smrszyqg user-30=lkpier user-31=steakbridieme user-32=donnychicago user-33=firstre5 user-34=ctedorgu user-35=philmcph user-36=nscdp user-37=putterfc user-38=foods user-39=leftie user-40=fortunaz user-41=health2045 user-42=romaldki user-43=ranxterc user-44=outdoorc user-45=hodgsonmail user-46=branko user-47=onlycont user-48=lucy
Sep 11 12:21:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=attlebor user-50=david user-51=careers user-52=nbhavers user-53=chrisdal user-54=mcdermos user-55=jennimil user-56=tomandle user-57=design user-58=stagingerris user-59=dancinggardener user-60=ladburyp user-61=kategilpin user-62=havantho user-63=cath user-64=sketchy user-65=nvihkvu user-66=tstardom user-67=oubpgvbx user-68=what user-69=bakery user-70=crrtipdl user-71=sosevalu user-72=boldover user-73=nove user-74=stephani user-75=leereyn1 user-76=agproduc user-77=still user-78=spectrum user-79=theblack user-80=hodgesonweb user-81=jarvisin user-82=ulsukarm user-83=vantagep user-84=athenare user-85=connect9 user-86=lbscrmod user-87=maflemin user-88=booff user-89=foundation user-90=markward user-91=magichat user-92=hhdugcor user-93=lbhyisi user-94=dickemery123 user-95=ptkxhsbt user-96=martsblo user-97=megacards user-98=musorguk user-99=wilsonsw user-100=strathar user-101=atestord user-102=sarafoundation
Sep 11 12:21:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=brmrjxl user-104=lakesan1 user-105=connectedshoppin user-106=thqkgnbz user-107=accooper user-108=ianrayne user-109=hubmaster user-110=putterfi user-111=fetch user-112=carsinyo user-113=gilpin user-114=milloyco user-115=elecleis user-116=firstred user-117=highlegh user-118=southlon user-119=firstrel user-120=clarkass user-121=costestimatorco user-122=opaiscyx user-123=coursemc user-124=ultbcrra user-125=jonhartl user-126=seftvta user-127=firstres user-128=nativene user-129=innovat1 user-130=askhform user-131=stuartge user-132=alexadmin user-133=skyfirec user-134=newstoda user-135=ggaaorgu user-136=belle user-137=bemadonn user-138=bedfords user-139=vivienn1 user-140=firstre2 user-141=oneoarco user-142=battlere user-143=nstriton user-144=brighto1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:21:34 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:21:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:35 nativespace-cdp sudo[598319]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:38 nativespace-cdp sudo[598383]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:21:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:39 nativespace-cdp sudo[598395]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:21:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:39 nativespace-cdp sudo[598402]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=theblack user-3=hodgesonweb user-4=spectrum user-5=agproduc user-6=still user-7=leereyn1 user-8=stephani user-9=booff user-10=markward user-11=foundation user-12=lbscrmod user-13=maflemin user-14=vantagep user-15=athenare user-16=connect9 user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=hhdugcor user-22=lbhyisi user-23=magichat user-24=brmrjxl user-25=lakesan1 user-26=atestord user-27=sarafoundation user-28=strathar user-29=wilsonsw user-30=megacards user-31=musorguk user-32=elecleis user-33=milloyco user-34=gilpin user-35=fetch user-36=carsinyo user-37=hubmaster user-38=putterfi user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=ultbcrra user-45=jonhartl user-46=seftvta user-47=opaiscyx
Sep 11 12:21:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=coursemc user-49=costestimatorco user-50=firstrel user-51=clarkass user-52=highlegh user-53=southlon user-54=firstred user-55=skyfirec user-56=alexadmin user-57=stuartge user-58=askhform user-59=innovat1 user-60=nativene user-61=nstriton user-62=brighto1 user-63=oneoarco user-64=battlere user-65=vivienn1 user-66=firstre2 user-67=bedfords user-68=bemadonn user-69=newstoda user-70=ggaaorgu user-71=belle user-72=fawcettd user-73=burydropin user-74=nsceres user-75=darkstar user-76=eatspam user-77=beauty user-78=dhyana user-79=sibtoncc user-80=asandcoc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=ninejimm user-85=reliable user-86=cambria1 user-87=cathski user-88=cwsocial user-89=paulmca1 user-90=pugwash user-91=howardon user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=foods user-96=leftie user-97=fortunaz user-98=health2045 user-99=nscdp user-100=putterfc user-101=steakbridieme
Sep 11 12:21:39 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=firstre5 user-103=donnychicago user-104=philmcph user-105=ctedorgu user-106=lkpier user-107=smrszyqg user-108=isleofwi user-109=barbersh user-110=tigerlet user-111=nomistakes user-112=hidden user-113=lucy user-114=attlebor user-115=onlycont user-116=branko user-117=ranxterc user-118=hodgsonmail user-119=outdoorc user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=david user-126=careers user-127=nbhavers user-128=what user-129=oubpgvbx user-130=tstardom user-131=nvihkvu user-132=havantho user-133=sketchy user-134=cath user-135=kategilpin user-136=dancinggardener user-137=stagingerris user-138=ladburyp user-139=design user-140=nove user-141=boldover user-142=crrtipdl user-143=sosevalu user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:21:39 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:21:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:40 nativespace-cdp sudo[598414]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:43 nativespace-cdp sudo[598489]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:21:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:43 nativespace-cdp sudo[598495]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:21:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:44 nativespace-cdp sudo[598501]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=branko user-2=ranxterc user-3=hodgsonmail user-4=outdoorc user-5=romaldki user-6=lucy user-7=attlebor user-8=onlycont user-9=mcdermos user-10=chrisdal user-11=david user-12=careers user-13=nbhavers user-14=tomandle user-15=jennimil user-16=kategilpin user-17=dancinggardener user-18=stagingerris user-19=ladburyp user-20=design user-21=what user-22=oubpgvbx user-23=tstardom user-24=nvihkvu user-25=havantho user-26=sketchy user-27=cath user-28=crrtipdl user-29=sosevalu user-30=bakery user-31=nove user-32=boldover user-33=darkstar user-34=eatspam user-35=beauty user-36=dhyana user-37=fawcettd user-38=burydropin user-39=nsceres user-40=zebrapho user-41=bwppodcast user-42=steve user-43=sibtoncc user-44=asandcoc user-45=hirefootballgame user-46=courseme user-47=eugincou user-48=reliable
Sep 11 12:21:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ninejimm user-50=cathski user-51=cambria1 user-52=cwsocial user-53=pugwash user-54=howardon user-55=paulmca1 user-56=smrszyqg user-57=isleofwi user-58=barbersh user-59=tigerlet user-60=nomistakes user-61=hidden user-62=leftie user-63=foods user-64=health2045 user-65=fortunaz user-66=nscdp user-67=putterfc user-68=steakbridieme user-69=donnychicago user-70=firstre5 user-71=ctedorgu user-72=philmcph user-73=lkpier user-74=ianrayne user-75=accooper user-76=thqkgnbz user-77=connectedshoppin user-78=elecleis user-79=milloyco user-80=gilpin user-81=fetch user-82=carsinyo user-83=putterfi user-84=hubmaster user-85=costestimatorco user-86=clarkass user-87=firstrel user-88=highlegh user-89=southlon user-90=firstred user-91=firstres user-92=ultbcrra user-93=seftvta user-94=jonhartl user-95=opaiscyx user-96=coursemc user-97=askhform user-98=stuartge user-99=innovat1 user-100=nativene user-101=alexadmin
Sep 11 12:21:44 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=skyfirec user-103=bedfords user-104=bemadonn user-105=newstoda user-106=ggaaorgu user-107=belle user-108=nstriton user-109=brighto1 user-110=oneoarco user-111=battlere user-112=vivienn1 user-113=firstre2 user-114=agproduc user-115=still user-116=leereyn1 user-117=stephani user-118=jarvisin user-119=theblack user-120=hodgesonweb user-121=spectrum user-122=ulsukarm user-123=booff user-124=markward user-125=foundation user-126=lbscrmod user-127=maflemin user-128=vantagep user-129=connect9 user-130=athenare user-131=hhdugcor user-132=lbhyisi user-133=magichat user-134=martsblo user-135=ptkxhsbt user-136=dickemery123 user-137=wilsonsw user-138=megacards user-139=musorguk user-140=lakesan1 user-141=brmrjxl user-142=atestord user-143=sarafoundation user-144=strathar feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 11 12:21:44 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:21:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:45 nativespace-cdp sudo[598519]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:54 nativespace-cdp sudo[598657]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:21:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:55 nativespace-cdp sudo[598671]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:21:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:55 nativespace-cdp sudo[598677]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nscdp user-2=putterfc user-3=leftie user-4=foods user-5=health2045 user-6=fortunaz user-7=lkpier user-8=steakbridieme user-9=firstre5 user-10=donnychicago user-11=philmcph user-12=ctedorgu user-13=isleofwi user-14=smrszyqg user-15=nomistakes user-16=hidden user-17=tigerlet user-18=barbersh user-19=cambria1 user-20=cathski user-21=reliable user-22=ninejimm user-23=cwsocial user-24=paulmca1 user-25=pugwash user-26=howardon user-27=hirefootballgame user-28=eugincou user-29=courseme user-30=asandcoc user-31=sibtoncc user-32=bwppodcast user-33=zebrapho user-34=steve user-35=fawcettd user-36=burydropin user-37=nsceres user-38=beauty user-39=darkstar user-40=eatspam user-41=dhyana user-42=nove user-43=boldover user-44=bakery user-45=crrtipdl user-46=sosevalu user-47=tstardom user-48=oubpgvbx
Sep 11 12:21:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=what user-50=havantho user-51=sketchy user-52=cath user-53=nvihkvu user-54=stagingerris user-55=dancinggardener user-56=ladburyp user-57=kategilpin user-58=design user-59=tomandle user-60=jennimil user-61=chrisdal user-62=mcdermos user-63=david user-64=careers user-65=nbhavers user-66=lucy user-67=attlebor user-68=onlycont user-69=outdoorc user-70=ranxterc user-71=hodgsonmail user-72=branko user-73=romaldki user-74=lakesan1 user-75=brmrjxl user-76=strathar user-77=atestord user-78=sarafoundation user-79=wilsonsw user-80=megacards user-81=musorguk user-82=martsblo user-83=dickemery123 user-84=ptkxhsbt user-85=hhdugcor user-86=lbhyisi user-87=magichat user-88=markward user-89=booff user-90=foundation user-91=vantagep user-92=connect9 user-93=athenare user-94=lbscrmod user-95=maflemin user-96=ulsukarm user-97=jarvisin user-98=spectrum user-99=hodgesonweb user-100=theblack user-101=agproduc user-102=still
Sep 11 12:21:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=stephani user-104=leereyn1 user-105=nstriton user-106=brighto1 user-107=vivienn1 user-108=firstre2 user-109=oneoarco user-110=battlere user-111=bedfords user-112=newstoda user-113=ggaaorgu user-114=belle user-115=bemadonn user-116=alexadmin user-117=skyfirec user-118=innovat1 user-119=stuartge user-120=askhform user-121=nativene user-122=ultbcrra user-123=seftvta user-124=jonhartl user-125=firstres user-126=opaiscyx user-127=coursemc user-128=clarkass user-129=firstrel user-130=costestimatorco user-131=firstred user-132=highlegh user-133=southlon user-134=gilpin user-135=milloyco user-136=elecleis user-137=hubmaster user-138=putterfi user-139=fetch user-140=carsinyo user-141=accooper user-142=ianrayne user-143=connectedshoppin user-144=thqkgnbz feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:21:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:21:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:56 nativespace-cdp sudo[598694]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:58 nativespace-cdp sudo[598753]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:21:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:58 nativespace-cdp sudo[598761]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:21:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:21:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:58 nativespace-cdp sudo[598786]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:21:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:58 nativespace-cdp sudo[598790]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:21:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:59 nativespace-cdp sudo[598772]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=alexadmin user-2=skyfirec user-3=askhform user-4=stuartge user-5=innovat1 user-6=nativene user-7=brighto1 user-8=nstriton user-9=battlere user-10=oneoarco user-11=firstre2 user-12=vivienn1 user-13=bedfords user-14=bemadonn user-15=ggaaorgu user-16=belle user-17=newstoda user-18=elecleis user-19=gilpin user-20=milloyco user-21=carsinyo user-22=fetch user-23=hubmaster user-24=putterfi user-25=ianrayne user-26=accooper user-27=thqkgnbz user-28=connectedshoppin user-29=firstres user-30=seftvta user-31=jonhartl user-32=ultbcrra user-33=coursemc user-34=opaiscyx user-35=costestimatorco user-36=clarkass user-37=firstrel user-38=southlon user-39=highlegh user-40=firstred user-41=martsblo user-42=ptkxhsbt user-43=dickemery123 user-44=lbhyisi user-45=hhdugcor user-46=magichat user-47=brmrjxl
Sep 11 12:21:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=lakesan1 user-49=sarafoundation user-50=atestord user-51=strathar user-52=wilsonsw user-53=musorguk user-54=megacards user-55=jarvisin user-56=hodgesonweb user-57=theblack user-58=spectrum user-59=still user-60=agproduc user-61=leereyn1 user-62=stephani user-63=foundation user-64=booff user-65=markward user-66=maflemin user-67=lbscrmod user-68=athenare user-69=connect9 user-70=vantagep user-71=ulsukarm user-72=what user-73=oubpgvbx user-74=tstardom user-75=nvihkvu user-76=cath user-77=sketchy user-78=havantho user-79=kategilpin user-80=ladburyp user-81=dancinggardener user-82=stagingerris user-83=design user-84=nove user-85=boldover user-86=sosevalu user-87=crrtipdl user-88=bakery user-89=attlebor user-90=lucy user-91=onlycont user-92=branko user-93=ranxterc user-94=outdoorc user-95=hodgsonmail user-96=romaldki user-97=tomandle user-98=jennimil user-99=mcdermos user-100=chrisdal user-101=nbhavers
Sep 11 12:21:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=careers user-103=david user-104=ninejimm user-105=reliable user-106=cambria1 user-107=cathski user-108=paulmca1 user-109=pugwash user-110=howardon user-111=cwsocial user-112=hirefootballgame user-113=courseme user-114=eugincou user-115=fortunaz user-116=health2045 user-117=leftie user-118=foods user-119=putterfc user-120=nscdp user-121=philmcph user-122=ctedorgu user-123=donnychicago user-124=steakbridieme user-125=firstre5 user-126=lkpier user-127=smrszyqg user-128=isleofwi user-129=barbersh user-130=tigerlet user-131=hidden user-132=nomistakes user-133=burydropin user-134=fawcettd user-135=nsceres user-136=eatspam user-137=darkstar user-138=beauty user-139=dhyana user-140=sibtoncc user-141=asandcoc user-142=zebrapho user-143=bwppodcast user-144=steve feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:21:59 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:21:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:59 nativespace-cdp sudo[598794]: pam_unix(sudo:session): session closed for user root
Sep 11 12:21:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=eugincou user-2=courseme user-3=hirefootballgame user-4=pugwash user-5=howardon user-6=paulmca1 user-7=cwsocial user-8=cambria1 user-9=cathski user-10=reliable user-11=ninejimm user-12=hidden user-13=nomistakes user-14=barbersh user-15=tigerlet user-16=isleofwi user-17=smrszyqg user-18=lkpier user-19=philmcph user-20=ctedorgu user-21=donnychicago user-22=firstre5 user-23=steakbridieme user-24=putterfc user-25=nscdp user-26=fortunaz user-27=health2045 user-28=leftie user-29=foods user-30=dhyana user-31=beauty user-32=eatspam user-33=darkstar user-34=nsceres user-35=burydropin user-36=fawcettd user-37=steve user-38=bwppodcast user-39=zebrapho user-40=asandcoc user-41=sibtoncc user-42=design user-43=ladburyp user-44=stagingerris user-45=dancinggardener user-46=kategilpin user-47=sketchy
Sep 11 12:21:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=cath user-49=havantho user-50=nvihkvu user-51=tstardom user-52=oubpgvbx user-53=what user-54=bakery user-55=sosevalu user-56=crrtipdl user-57=boldover user-58=nove user-59=romaldki user-60=hodgsonmail user-61=outdoorc user-62=ranxterc user-63=branko user-64=onlycont user-65=attlebor user-66=lucy user-67=careers user-68=nbhavers user-69=david user-70=chrisdal user-71=mcdermos user-72=jennimil user-73=tomandle user-74=magichat user-75=lbhyisi user-76=hhdugcor user-77=dickemery123 user-78=ptkxhsbt user-79=martsblo user-80=musorguk user-81=megacards user-82=wilsonsw user-83=strathar user-84=sarafoundation user-85=atestord user-86=brmrjxl user-87=lakesan1 user-88=stephani user-89=leereyn1 user-90=still user-91=agproduc user-92=spectrum user-93=theblack user-94=hodgesonweb user-95=jarvisin user-96=ulsukarm user-97=athenare user-98=connect9 user-99=vantagep user-100=maflemin user-101=lbscrmod user-102=booff
Sep 11 12:21:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=foundation user-104=markward user-105=nativene user-106=innovat1 user-107=askhform user-108=stuartge user-109=skyfirec user-110=alexadmin user-111=ggaaorgu user-112=belle user-113=newstoda user-114=bemadonn user-115=bedfords user-116=firstre2 user-117=vivienn1 user-118=battlere user-119=oneoarco user-120=brighto1 user-121=nstriton user-122=connectedshoppin user-123=thqkgnbz user-124=accooper user-125=ianrayne user-126=putterfi user-127=hubmaster user-128=carsinyo user-129=fetch user-130=gilpin user-131=milloyco user-132=elecleis user-133=firstred user-134=southlon user-135=highlegh user-136=clarkass user-137=firstrel user-138=costestimatorco user-139=opaiscyx user-140=coursemc user-141=jonhartl user-142=seftvta user-143=ultbcrra user-144=firstres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:21:59 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:21:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:21:59 nativespace-cdp sudo[598803]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:00 nativespace-cdp sudo[598815]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:22:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:06 nativespace-cdp sudo[598933]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:22:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:06 nativespace-cdp sudo[598940]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:22:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:06 nativespace-cdp sudo[598948]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=wilsonsw user-2=megacards user-3=musorguk user-4=lakesan1 user-5=brmrjxl user-6=strathar user-7=atestord user-8=sarafoundation user-9=hhdugcor user-10=lbhyisi user-11=magichat user-12=martsblo user-13=dickemery123 user-14=ptkxhsbt user-15=ulsukarm user-16=markward user-17=booff user-18=foundation user-19=vantagep user-20=connect9 user-21=athenare user-22=lbscrmod user-23=maflemin user-24=agproduc user-25=still user-26=stephani user-27=leereyn1 user-28=jarvisin user-29=spectrum user-30=theblack user-31=hodgesonweb user-32=bedfords user-33=newstoda user-34=belle user-35=ggaaorgu user-36=bemadonn user-37=nstriton user-38=brighto1 user-39=vivienn1 user-40=firstre2 user-41=oneoarco user-42=battlere user-43=innovat1 user-44=stuartge user-45=askhform user-46=nativene user-47=alexadmin user-48=skyfirec
Sep 11 12:22:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstrel user-50=clarkass user-51=costestimatorco user-52=firstred user-53=highlegh user-54=southlon user-55=ultbcrra user-56=seftvta user-57=jonhartl user-58=firstres user-59=opaiscyx user-60=coursemc user-61=accooper user-62=ianrayne user-63=connectedshoppin user-64=thqkgnbz user-65=milloyco user-66=gilpin user-67=elecleis user-68=putterfi user-69=hubmaster user-70=fetch user-71=carsinyo user-72=isleofwi user-73=smrszyqg user-74=nomistakes user-75=hidden user-76=barbersh user-77=tigerlet user-78=nscdp user-79=putterfc user-80=leftie user-81=foods user-82=fortunaz user-83=health2045 user-84=lkpier user-85=firstre5 user-86=donnychicago user-87=steakbridieme user-88=ctedorgu user-89=philmcph user-90=hirefootballgame user-91=eugincou user-92=courseme user-93=cambria1 user-94=cathski user-95=ninejimm user-96=reliable user-97=cwsocial user-98=howardon user-99=paulmca1 user-100=pugwash user-101=bwppodcast
Sep 11 12:22:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=zebrapho user-103=steve user-104=asandcoc user-105=sibtoncc user-106=beauty user-107=darkstar user-108=eatspam user-109=dhyana user-110=fawcettd user-111=burydropin user-112=nsceres user-113=bakery user-114=crrtipdl user-115=sosevalu user-116=nove user-117=boldover user-118=dancinggardener user-119=stagingerris user-120=ladburyp user-121=kategilpin user-122=design user-123=oubpgvbx user-124=tstardom user-125=what user-126=havantho user-127=cath user-128=sketchy user-129=nvihkvu user-130=chrisdal user-131=mcdermos user-132=david user-133=nbhavers user-134=careers user-135=tomandle user-136=jennimil user-137=hodgsonmail user-138=outdoorc user-139=ranxterc user-140=branko user-141=romaldki user-142=lucy user-143=attlebor user-144=onlycont feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:22:06 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:22:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:07 nativespace-cdp sudo[598965]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:22:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:08 nativespace-cdp sudo[599009]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 12:22:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:09 nativespace-cdp sudo[599015]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 12:22:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:09 nativespace-cdp sudo[599026]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=theblack user-3=hodgesonweb user-4=spectrum user-5=still user-6=agproduc user-7=leereyn1 user-8=stephani user-9=foundation user-10=booff user-11=markward user-12=maflemin user-13=lbscrmod user-14=athenare user-15=connect9 user-16=vantagep user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=lbhyisi user-22=hhdugcor user-23=magichat user-24=lakesan1 user-25=brmrjxl user-26=sarafoundation user-27=atestord user-28=strathar user-29=wilsonsw user-30=musorguk user-31=megacards user-32=elecleis user-33=gilpin user-34=milloyco user-35=carsinyo user-36=fetch user-37=putterfi user-38=hubmaster user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=seftvta user-45=jonhartl user-46=ultbcrra user-47=opaiscyx
Sep 11 12:22:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=coursemc user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=southlon user-53=highlegh user-54=firstred user-55=alexadmin user-56=skyfirec user-57=askhform user-58=stuartge user-59=innovat1 user-60=nativene user-61=brighto1 user-62=nstriton user-63=battlere user-64=oneoarco user-65=firstre2 user-66=vivienn1 user-67=bedfords user-68=bemadonn user-69=belle user-70=ggaaorgu user-71=newstoda user-72=burydropin user-73=fawcettd user-74=nsceres user-75=eatspam user-76=darkstar user-77=beauty user-78=dhyana user-79=asandcoc user-80=sibtoncc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=ninejimm user-85=reliable user-86=cambria1 user-87=cathski user-88=paulmca1 user-89=pugwash user-90=howardon user-91=cwsocial user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=health2045 user-96=fortunaz user-97=leftie user-98=foods user-99=putterfc user-100=nscdp user-101=philmcph
Sep 11 12:22:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ctedorgu user-103=steakbridieme user-104=firstre5 user-105=donnychicago user-106=lkpier user-107=isleofwi user-108=smrszyqg user-109=barbersh user-110=tigerlet user-111=hidden user-112=nomistakes user-113=attlebor user-114=lucy user-115=onlycont user-116=branko user-117=ranxterc user-118=hodgsonmail user-119=outdoorc user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=nbhavers user-126=careers user-127=david user-128=what user-129=tstardom user-130=oubpgvbx user-131=nvihkvu user-132=sketchy user-133=cath user-134=havantho user-135=kategilpin user-136=ladburyp user-137=dancinggardener user-138=stagingerris user-139=design user-140=nove user-141=boldover user-142=sosevalu user-143=crrtipdl user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 12:22:09 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 12:22:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:10 nativespace-cdp sudo[599041]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:22:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:13 nativespace-cdp sudo[599089]: pam_unix(sudo:session): session closed for user root
Sep 11 12:22:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 12:22:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 12:22:19 nativespace-cdp sudo[599130]: pam_unix(sudo:session): session closed for user root
Sep 11 12:26:33 nativespace-cdp sshd[600905]: Connection closed by 159.100.136.21 port 53328 [preauth]
Sep 11 12:31:34 nativespace-cdp sshd[602534]: Connection closed by 159.100.136.21 port 33944 [preauth]
Sep 11 12:36:33 nativespace-cdp sshd[604054]: Connection closed by 159.100.136.21 port 42818 [preauth]
Sep 11 12:41:36 nativespace-cdp sshd[605687]: Connection closed by 159.100.136.21 port 52246 [preauth]
Sep 11 12:46:34 nativespace-cdp sshd[607344]: Connection closed by 159.100.136.21 port 33602 [preauth]
Sep 11 12:56:33 nativespace-cdp sshd[609876]: Connection closed by 159.100.136.21 port 51658 [preauth]
Sep 11 13:01:39 nativespace-cdp sshd[612169]: Connection closed by 159.100.136.21 port 60606 [preauth]
Sep 11 13:05:19 nativespace-cdp crond[613127]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 11 13:05:19 nativespace-cdp crond[613128]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 11 13:06:33 nativespace-cdp sshd[613779]: Connection closed by 159.100.136.21 port 42138 [preauth]
Sep 11 13:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 13:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:05 nativespace-cdp sudo[615489]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 13:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:05 nativespace-cdp sudo[615495]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 13:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:07 nativespace-cdp sudo[615499]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 13:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:07 nativespace-cdp sudo[615519]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 13:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:13 nativespace-cdp sudo[615525]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 13:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:13 nativespace-cdp sudo[615593]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 13:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:13 nativespace-cdp sudo[615598]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 13:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:13 nativespace-cdp sudo[615602]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 13:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:13 nativespace-cdp sudo[615607]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 13:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:13 nativespace-cdp sudo[615612]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 13:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:14 nativespace-cdp sudo[615618]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 13:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:17 nativespace-cdp sudo[615642]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 13:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:20 nativespace-cdp sudo[615648]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=onlycont user-2=attlebor user-3=lucy user-4=romaldki user-5=branko user-6=hodgsonmail user-7=outdoorc user-8=ranxterc user-9=jennimil user-10=tomandle user-11=nbhavers user-12=careers user-13=david user-14=mcdermos user-15=chrisdal user-16=nvihkvu user-17=sketchy user-18=cath user-19=havantho user-20=what user-21=oubpgvbx user-22=tstardom user-23=design user-24=kategilpin user-25=ladburyp user-26=dancinggardener user-27=stagingerris user-28=boldover user-29=nove user-30=sosevalu user-31=crrtipdl user-32=bakery user-33=nsceres user-34=burydropin user-35=fawcettd user-36=dhyana user-37=eatspam user-38=darkstar user-39=beauty user-40=asandcoc user-41=sibtoncc user-42=steve user-43=zebrapho user-44=bwppodcast user-45=howardon user-46=pugwash user-47=paulmca1 user-48=cwsocial user-49=ninejimm
Sep 11 13:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=reliable user-51=cathski user-52=cambria1 user-53=courseme user-54=eugincou user-55=hirefootballgame user-56=ctedorgu user-57=philmcph user-58=firstre5 user-59=steakbridieme user-60=donnychicago user-61=lkpier user-62=health2045 user-63=fortunaz user-64=leftie user-65=foods user-66=putterfc user-67=nscdp user-68=tigerlet user-69=barbersh user-70=hidden user-71=nomistakes user-72=smrszyqg user-73=isleofwi user-74=carsinyo user-75=fetch user-76=putterfi user-77=hubmaster user-78=elecleis user-79=gilpin user-80=milloyco user-81=thqkgnbz user-82=connectedshoppin user-83=ianrayne user-84=accooper user-85=opaiscyx user-86=coursemc user-87=firstres user-88=seftvta user-89=jonhartl user-90=ultbcrra user-91=southlon user-92=highlegh user-93=firstred user-94=costestimatorco user-95=firstrel user-96=clarkass user-97=skyfirec user-98=alexadmin user-99=nativene user-100=askhform user-101=stuartge user-102=innovat1
Sep 11 13:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=battlere user-104=oneoarco user-105=firstre2 user-106=vivienn1 user-107=brighto1 user-108=nstriton user-109=bemadonn user-110=ggaaorgu user-111=belle user-112=newstoda user-113=bedfords user-114=hodgesonweb user-115=theblack user-116=spectrum user-117=jarvisin user-118=leereyn1 user-119=stephani user-120=still user-121=agproduc user-122=maflemin user-123=lbscrmod user-124=athenare user-125=connect9 user-126=vantagep user-127=booff user-128=foundation user-129=markward user-130=ulsukarm user-131=ptkxhsbt user-132=dickemery123 user-133=martsblo user-134=magichat user-135=lbhyisi user-136=hhdugcor user-137=sarafoundation user-138=atestord user-139=strathar user-140=brmrjxl user-141=lakesan1 user-142=musorguk user-143=megacards user-144=wilsonsw feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 13:10:20 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 13:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:21 nativespace-cdp sudo[615660]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 13:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:21 nativespace-cdp sudo[615670]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2sMG4ABXC9j3OnGq.~
Sep 11 13:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:21 nativespace-cdp sudo[615677]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2sMG4ABXC9j3OnGq.~'
Sep 11 13:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:22 nativespace-cdp sudo[615681]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2sMG4ABXC9j3OnGq.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 13:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:22 nativespace-cdp sudo[615687]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 13:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:22 nativespace-cdp sudo[615692]: pam_unix(sudo:session): session closed for user root
Sep 11 13:10:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 13:10:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 13:10:44 nativespace-cdp sudo[615948]: pam_unix(sudo:session): session closed for user root
Sep 11 13:11:35 nativespace-cdp sshd[616293]: Connection closed by 159.100.136.21 port 51472 [preauth]
Sep 11 13:16:34 nativespace-cdp sshd[618552]: Connection closed by 159.100.136.21 port 60992 [preauth]
Sep 11 13:21:35 nativespace-cdp sshd[621357]: Connection closed by 159.100.136.21 port 41626 [preauth]
Sep 11 13:26:33 nativespace-cdp sshd[623969]: Connection closed by 159.100.136.21 port 51042 [preauth]
Sep 11 13:31:34 nativespace-cdp sshd[626752]: Connection closed by 159.100.136.21 port 60376 [preauth]
Sep 11 13:36:33 nativespace-cdp sshd[628864]: Connection closed by 159.100.136.21 port 40834 [preauth]
Sep 11 13:41:33 nativespace-cdp sshd[630228]: Connection closed by 159.100.136.21 port 48862 [preauth]
Sep 11 13:46:33 nativespace-cdp sshd[631825]: Connection closed by 159.100.136.21 port 57918 [preauth]
Sep 11 13:51:35 nativespace-cdp sshd[633096]: Connection closed by 159.100.136.21 port 38650 [preauth]
Sep 11 13:56:33 nativespace-cdp sshd[634595]: Connection closed by 159.100.136.21 port 48378 [preauth]
Sep 11 14:01:34 nativespace-cdp sshd[636154]: Connection closed by 159.100.136.21 port 57476 [preauth]
Sep 11 14:06:33 nativespace-cdp sshd[637471]: Connection closed by 159.100.136.21 port 38162 [preauth]
Sep 11 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:06 nativespace-cdp sudo[638340]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:06 nativespace-cdp sudo[638344]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:09 nativespace-cdp sudo[638347]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 14:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:09 nativespace-cdp sudo[638359]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 14:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:15 nativespace-cdp sudo[638363]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:15 nativespace-cdp sudo[638388]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:15 nativespace-cdp sudo[638391]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:15 nativespace-cdp sudo[638394]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:15 nativespace-cdp sudo[638398]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:15 nativespace-cdp sudo[638401]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 14:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:15 nativespace-cdp sudo[638404]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 14:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:19 nativespace-cdp sudo[638417]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 14:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:19 nativespace-cdp sudo[638422]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=firstre2 user-2=vivienn1 user-3=battlere user-4=oneoarco user-5=brighto1 user-6=nstriton user-7=ggaaorgu user-8=belle user-9=newstoda user-10=bemadonn user-11=bedfords user-12=alexadmin user-13=skyfirec user-14=nativene user-15=innovat1 user-16=stuartge user-17=askhform user-18=coursemc user-19=opaiscyx user-20=seftvta user-21=jonhartl user-22=ultbcrra user-23=firstres user-24=firstred user-25=southlon user-26=highlegh user-27=clarkass user-28=firstrel user-29=costestimatorco user-30=hubmaster user-31=putterfi user-32=carsinyo user-33=fetch user-34=milloyco user-35=gilpin user-36=elecleis user-37=connectedshoppin user-38=thqkgnbz user-39=accooper user-40=ianrayne user-41=strathar user-42=sarafoundation user-43=atestord user-44=brmrjxl user-45=lakesan1 user-46=musorguk user-47=megacards
Sep 11 14:10:19 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=wilsonsw user-49=dickemery123 user-50=ptkxhsbt user-51=martsblo user-52=magichat user-53=lbhyisi user-54=hhdugcor user-55=connect9 user-56=athenare user-57=vantagep user-58=maflemin user-59=lbscrmod user-60=booff user-61=markward user-62=foundation user-63=ulsukarm user-64=spectrum user-65=hodgesonweb user-66=theblack user-67=jarvisin user-68=stephani user-69=leereyn1 user-70=still user-71=agproduc user-72=boldover user-73=nove user-74=bakery user-75=sosevalu user-76=crrtipdl user-77=sketchy user-78=cath user-79=havantho user-80=nvihkvu user-81=tstardom user-82=oubpgvbx user-83=what user-84=design user-85=ladburyp user-86=dancinggardener user-87=stagingerris user-88=kategilpin user-89=jennimil user-90=tomandle user-91=nbhavers user-92=careers user-93=david user-94=chrisdal user-95=mcdermos user-96=onlycont user-97=attlebor user-98=lucy user-99=romaldki user-100=ranxterc user-101=outdoorc
Sep 11 14:10:19 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hodgsonmail user-103=branko user-104=lkpier user-105=ctedorgu user-106=philmcph user-107=firstre5 user-108=steakbridieme user-109=donnychicago user-110=putterfc user-111=nscdp user-112=fortunaz user-113=health2045 user-114=leftie user-115=foods user-116=hidden user-117=nomistakes user-118=barbersh user-119=tigerlet user-120=isleofwi user-121=smrszyqg user-122=pugwash user-123=paulmca1 user-124=howardon user-125=cwsocial user-126=cambria1 user-127=cathski user-128=ninejimm user-129=reliable user-130=eugincou user-131=courseme user-132=hirefootballgame user-133=sibtoncc user-134=asandcoc user-135=steve user-136=bwppodcast user-137=zebrapho user-138=nsceres user-139=burydropin user-140=fawcettd user-141=dhyana user-142=beauty user-143=eatspam user-144=darkstar feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 11 14:10:19 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 14:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:20 nativespace-cdp sudo[638427]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 14:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:21 nativespace-cdp sudo[638440]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cis3mMwwPSKPBorG.~
Sep 11 14:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:22 nativespace-cdp sudo[638444]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cis3mMwwPSKPBorG.~'
Sep 11 14:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:22 nativespace-cdp sudo[638447]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cis3mMwwPSKPBorG.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 14:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:22 nativespace-cdp sudo[638451]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 14:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:22 nativespace-cdp sudo[638454]: pam_unix(sudo:session): session closed for user root
Sep 11 14:10:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 14:10:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 14:10:34 nativespace-cdp sudo[638506]: pam_unix(sudo:session): session closed for user root
Sep 11 14:11:33 nativespace-cdp sshd[639305]: Connection closed by 159.100.136.21 port 46320 [preauth]
Sep 11 14:16:34 nativespace-cdp sshd[640998]: Connection closed by 159.100.136.21 port 55990 [preauth]
Sep 11 14:21:35 nativespace-cdp sshd[642449]: Connection closed by 159.100.136.21 port 36452 [preauth]
Sep 11 14:26:33 nativespace-cdp sshd[643697]: Connection closed by 159.100.136.21 port 44640 [preauth]
Sep 11 14:31:33 nativespace-cdp sshd[645684]: Connection closed by 159.100.136.21 port 53614 [preauth]
Sep 11 14:36:33 nativespace-cdp sshd[646978]: Connection closed by 159.100.136.21 port 33750 [preauth]
Sep 11 14:41:33 nativespace-cdp sshd[648337]: Connection closed by 159.100.136.21 port 42068 [preauth]
Sep 11 14:46:37 nativespace-cdp sshd[649753]: Connection closed by 159.100.136.21 port 51440 [preauth]
Sep 11 14:51:36 nativespace-cdp sshd[651468]: Connection closed by 159.100.136.21 port 60188 [preauth]
Sep 11 14:56:33 nativespace-cdp sshd[652998]: Connection closed by 159.100.136.21 port 41176 [preauth]
Sep 11 15:01:33 nativespace-cdp sshd[655151]: Connection closed by 159.100.136.21 port 50248 [preauth]
Sep 11 15:06:33 nativespace-cdp sshd[669702]: Connection closed by 159.100.136.21 port 58054 [preauth]
Sep 11 15:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 15:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:00 nativespace-cdp sudo[675817]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 15:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:00 nativespace-cdp sudo[675829]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 15:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:03 nativespace-cdp sudo[675835]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 15:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:03 nativespace-cdp sudo[676019]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 15:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:07 nativespace-cdp sudo[676024]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 15:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:07 nativespace-cdp sudo[676114]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 15:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:08 nativespace-cdp sudo[676119]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 15:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:08 nativespace-cdp sudo[676123]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 15:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:08 nativespace-cdp sudo[676126]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 15:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:08 nativespace-cdp sudo[676129]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 15:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:08 nativespace-cdp sudo[676133]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 15:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:17 nativespace-cdp sudo[676353]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 15:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:18 nativespace-cdp sudo[676379]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=chrisdal user-4=mcdermos user-5=david user-6=careers user-7=nbhavers user-8=lucy user-9=attlebor user-10=onlycont user-11=outdoorc user-12=hodgsonmail user-13=ranxterc user-14=branko user-15=romaldki user-16=nove user-17=boldover user-18=bakery user-19=crrtipdl user-20=sosevalu user-21=tstardom user-22=oubpgvbx user-23=what user-24=havantho user-25=sketchy user-26=cath user-27=nvihkvu user-28=dancinggardener user-29=stagingerris user-30=ladburyp user-31=kategilpin user-32=design user-33=sibtoncc user-34=asandcoc user-35=bwppodcast user-36=zebrapho user-37=steve user-38=fawcettd user-39=burydropin user-40=nsceres user-41=beauty user-42=darkstar user-43=eatspam user-44=dhyana user-45=nscdp user-46=putterfc user-47=foods user-48=leftie user-49=health2045
Sep 11 15:10:18 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=fortunaz user-51=lkpier user-52=firstre5 user-53=steakbridieme user-54=donnychicago user-55=philmcph user-56=ctedorgu user-57=isleofwi user-58=smrszyqg user-59=nomistakes user-60=hidden user-61=barbersh user-62=tigerlet user-63=cambria1 user-64=cathski user-65=reliable user-66=ninejimm user-67=cwsocial user-68=pugwash user-69=howardon user-70=paulmca1 user-71=hirefootballgame user-72=eugincou user-73=courseme user-74=ultbcrra user-75=jonhartl user-76=seftvta user-77=firstres user-78=opaiscyx user-79=coursemc user-80=firstrel user-81=clarkass user-82=costestimatorco user-83=firstred user-84=highlegh user-85=southlon user-86=milloyco user-87=gilpin user-88=elecleis user-89=putterfi user-90=hubmaster user-91=fetch user-92=carsinyo user-93=accooper user-94=ianrayne user-95=connectedshoppin user-96=thqkgnbz user-97=nstriton user-98=brighto1 user-99=vivienn1 user-100=firstre2 user-101=oneoarco user-102=battlere
Sep 11 15:10:18 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=newstoda user-105=ggaaorgu user-106=belle user-107=bemadonn user-108=skyfirec user-109=alexadmin user-110=innovat1 user-111=askhform user-112=stuartge user-113=nativene user-114=foundation user-115=booff user-116=markward user-117=vantagep user-118=athenare user-119=connect9 user-120=lbscrmod user-121=maflemin user-122=ulsukarm user-123=jarvisin user-124=spectrum user-125=hodgesonweb user-126=theblack user-127=agproduc user-128=still user-129=stephani user-130=leereyn1 user-131=lakesan1 user-132=brmrjxl user-133=strathar user-134=atestord user-135=sarafoundation user-136=wilsonsw user-137=megacards user-138=musorguk user-139=martsblo user-140=dickemery123 user-141=ptkxhsbt user-142=hhdugcor user-143=lbhyisi user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 15:10:18 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 15:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:20 nativespace-cdp sudo[676390]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 15:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:21 nativespace-cdp sudo[676475]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AmoXM5Gdr1cQiKIm.~
Sep 11 15:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:21 nativespace-cdp sudo[676480]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AmoXM5Gdr1cQiKIm.~'
Sep 11 15:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:21 nativespace-cdp sudo[676484]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AmoXM5Gdr1cQiKIm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 15:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:21 nativespace-cdp sudo[676488]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 15:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:21 nativespace-cdp sudo[676492]: pam_unix(sudo:session): session closed for user root
Sep 11 15:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 15:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 15:10:24 nativespace-cdp sudo[676550]: pam_unix(sudo:session): session closed for user root
Sep 11 15:11:33 nativespace-cdp sshd[678556]: Connection closed by 159.100.136.21 port 38678 [preauth]
Sep 11 15:16:34 nativespace-cdp sshd[684656]: Connection closed by 159.100.136.21 port 48588 [preauth]
Sep 11 15:18:31 nativespace-cdp sshd[685121]: Invalid user ubuntu from 103.153.254.60 port 39430
Sep 11 15:18:31 nativespace-cdp sshd[685121]: input_userauth_request: invalid user ubuntu [preauth]
Sep 11 15:18:31 nativespace-cdp sshd[685121]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 15:18:31 nativespace-cdp sshd[685121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.153.254.60
Sep 11 15:18:33 nativespace-cdp sshd[685121]: Failed password for invalid user ubuntu from 103.153.254.60 port 39430 ssh2
Sep 11 15:18:34 nativespace-cdp sshd[685121]: Received disconnect from 103.153.254.60 port 39430:11: Bye Bye [preauth]
Sep 11 15:18:34 nativespace-cdp sshd[685121]: Disconnected from 103.153.254.60 port 39430 [preauth]
Sep 11 15:21:33 nativespace-cdp sshd[685890]: Connection closed by 159.100.136.21 port 57858 [preauth]
Sep 11 15:23:55 nativespace-cdp sshd[686475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.153.254.60  user=root
Sep 11 15:23:55 nativespace-cdp sshd[686475]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 15:23:57 nativespace-cdp sshd[686475]: Failed password for root from 103.153.254.60 port 39670 ssh2
Sep 11 15:23:57 nativespace-cdp sshd[686475]: Received disconnect from 103.153.254.60 port 39670:11: Bye Bye [preauth]
Sep 11 15:23:57 nativespace-cdp sshd[686475]: Disconnected from 103.153.254.60 port 39670 [preauth]
Sep 11 15:23:58 nativespace-cdp sshd[686519]: Invalid user isis from 177.12.2.75 port 60468
Sep 11 15:23:58 nativespace-cdp sshd[686519]: input_userauth_request: invalid user isis [preauth]
Sep 11 15:23:58 nativespace-cdp sshd[686519]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 15:23:58 nativespace-cdp sshd[686519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.12.2.75
Sep 11 15:24:00 nativespace-cdp sshd[686519]: Failed password for invalid user isis from 177.12.2.75 port 60468 ssh2
Sep 11 15:24:00 nativespace-cdp sshd[686519]: Received disconnect from 177.12.2.75 port 60468:11: Bye Bye [preauth]
Sep 11 15:24:00 nativespace-cdp sshd[686519]: Disconnected from 177.12.2.75 port 60468 [preauth]
Sep 11 15:24:58 nativespace-cdp sshd[686747]: Invalid user spider from 103.153.254.60 port 39734
Sep 11 15:24:58 nativespace-cdp sshd[686747]: input_userauth_request: invalid user spider [preauth]
Sep 11 15:24:58 nativespace-cdp sshd[686747]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 15:24:58 nativespace-cdp sshd[686747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.153.254.60
Sep 11 15:25:00 nativespace-cdp sshd[686747]: Failed password for invalid user spider from 103.153.254.60 port 39734 ssh2
Sep 11 15:25:00 nativespace-cdp sshd[686747]: Received disconnect from 103.153.254.60 port 39734:11: Bye Bye [preauth]
Sep 11 15:25:00 nativespace-cdp sshd[686747]: Disconnected from 103.153.254.60 port 39734 [preauth]
Sep 11 15:26:37 nativespace-cdp sshd[687376]: Connection closed by 159.100.136.21 port 39488 [preauth]
Sep 11 15:26:44 nativespace-cdp sshd[687383]: Invalid user devuser from 177.12.2.75 port 55800
Sep 11 15:26:44 nativespace-cdp sshd[687383]: input_userauth_request: invalid user devuser [preauth]
Sep 11 15:26:44 nativespace-cdp sshd[687383]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 15:26:44 nativespace-cdp sshd[687383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.12.2.75
Sep 11 15:26:47 nativespace-cdp sshd[687383]: Failed password for invalid user devuser from 177.12.2.75 port 55800 ssh2
Sep 11 15:26:47 nativespace-cdp sshd[687383]: Received disconnect from 177.12.2.75 port 55800:11: Bye Bye [preauth]
Sep 11 15:26:47 nativespace-cdp sshd[687383]: Disconnected from 177.12.2.75 port 55800 [preauth]
Sep 11 15:27:44 nativespace-cdp sshd[687577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.12.2.75  user=root
Sep 11 15:27:44 nativespace-cdp sshd[687577]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 15:27:46 nativespace-cdp sshd[687577]: Failed password for root from 177.12.2.75 port 35472 ssh2
Sep 11 15:27:46 nativespace-cdp sshd[687577]: Received disconnect from 177.12.2.75 port 35472:11: Bye Bye [preauth]
Sep 11 15:27:46 nativespace-cdp sshd[687577]: Disconnected from 177.12.2.75 port 35472 [preauth]
Sep 11 15:31:33 nativespace-cdp sshd[688911]: Connection closed by 159.100.136.21 port 48908 [preauth]
Sep 11 15:36:33 nativespace-cdp sshd[690567]: Connection closed by 159.100.136.21 port 58306 [preauth]
Sep 11 15:41:35 nativespace-cdp sshd[692156]: Connection closed by 159.100.136.21 port 39476 [preauth]
Sep 11 15:46:33 nativespace-cdp sshd[693486]: Connection closed by 159.100.136.21 port 48622 [preauth]
Sep 11 15:56:35 nativespace-cdp sshd[696648]: Connection closed by 159.100.136.21 port 39064 [preauth]
Sep 11 16:01:34 nativespace-cdp sshd[698032]: Connection closed by 159.100.136.21 port 48310 [preauth]
Sep 11 16:06:33 nativespace-cdp sshd[699736]: Connection closed by 159.100.136.21 port 57932 [preauth]
Sep 11 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:09:56 nativespace-cdp sudo[700542]: pam_unix(sudo:session): session closed for user root
Sep 11 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:09:56 nativespace-cdp sudo[700547]: pam_unix(sudo:session): session closed for user root
Sep 11 16:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 16:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:09:58 nativespace-cdp sudo[700552]: pam_unix(sudo:session): session closed for user root
Sep 11 16:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 16:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:09:58 nativespace-cdp sudo[700561]: pam_unix(sudo:session): session closed for user root
Sep 11 16:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 16:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:01 nativespace-cdp sudo[700567]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:02 nativespace-cdp sudo[700672]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:02 nativespace-cdp sudo[700677]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:02 nativespace-cdp sudo[700681]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:02 nativespace-cdp sudo[700686]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:02 nativespace-cdp sudo[700693]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:02 nativespace-cdp sudo[700698]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 16:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:15 nativespace-cdp sudo[700823]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 16:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:18 nativespace-cdp sudo[700831]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=firstred user-2=southlon user-3=highlegh user-4=clarkass user-5=firstrel user-6=costestimatorco user-7=coursemc user-8=opaiscyx user-9=seftvta user-10=jonhartl user-11=ultbcrra user-12=firstres user-13=connectedshoppin user-14=thqkgnbz user-15=accooper user-16=ianrayne user-17=putterfi user-18=hubmaster user-19=carsinyo user-20=fetch user-21=gilpin user-22=milloyco user-23=elecleis user-24=ggaaorgu user-25=belle user-26=newstoda user-27=bemadonn user-28=bedfords user-29=firstre2 user-30=vivienn1 user-31=battlere user-32=oneoarco user-33=brighto1 user-34=nstriton user-35=nativene user-36=innovat1 user-37=askhform user-38=stuartge user-39=skyfirec user-40=alexadmin user-41=ulsukarm user-42=connect9 user-43=athenare user-44=vantagep user-45=maflemin user-46=lbscrmod user-47=markward user-48=booff
Sep 11 16:10:18 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=foundation user-50=stephani user-51=leereyn1 user-52=still user-53=agproduc user-54=spectrum user-55=hodgesonweb user-56=theblack user-57=jarvisin user-58=musorguk user-59=megacards user-60=wilsonsw user-61=strathar user-62=sarafoundation user-63=atestord user-64=brmrjxl user-65=lakesan1 user-66=magichat user-67=lbhyisi user-68=hhdugcor user-69=dickemery123 user-70=ptkxhsbt user-71=martsblo user-72=nbhavers user-73=careers user-74=david user-75=chrisdal user-76=mcdermos user-77=jennimil user-78=tomandle user-79=romaldki user-80=outdoorc user-81=ranxterc user-82=hodgsonmail user-83=branko user-84=onlycont user-85=attlebor user-86=lucy user-87=bakery user-88=sosevalu user-89=crrtipdl user-90=boldover user-91=nove user-92=design user-93=ladburyp user-94=dancinggardener user-95=stagingerris user-96=kategilpin user-97=cath user-98=sketchy user-99=havantho user-100=nvihkvu user-101=tstardom user-102=oubpgvbx
Sep 11 16:10:18 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=what user-104=steve user-105=bwppodcast user-106=zebrapho user-107=asandcoc user-108=sibtoncc user-109=dhyana user-110=beauty user-111=eatspam user-112=darkstar user-113=nsceres user-114=burydropin user-115=fawcettd user-116=hidden user-117=nomistakes user-118=barbersh user-119=tigerlet user-120=isleofwi user-121=smrszyqg user-122=lkpier user-123=philmcph user-124=ctedorgu user-125=donnychicago user-126=steakbridieme user-127=firstre5 user-128=putterfc user-129=nscdp user-130=fortunaz user-131=health2045 user-132=leftie user-133=foods user-134=eugincou user-135=courseme user-136=hirefootballgame user-137=howardon user-138=paulmca1 user-139=pugwash user-140=cwsocial user-141=cambria1 user-142=cathski user-143=ninejimm user-144=reliable feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 16:10:18 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 16:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:19 nativespace-cdp sudo[700851]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 16:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:20 nativespace-cdp sudo[700859]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-lXXnqZ7yEigdDlc5.~
Sep 11 16:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:20 nativespace-cdp sudo[700864]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-lXXnqZ7yEigdDlc5.~'
Sep 11 16:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:20 nativespace-cdp sudo[700868]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-lXXnqZ7yEigdDlc5.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 16:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:20 nativespace-cdp sudo[700874]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 16:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:20 nativespace-cdp sudo[700880]: pam_unix(sudo:session): session closed for user root
Sep 11 16:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 16:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 16:10:22 nativespace-cdp sudo[700905]: pam_unix(sudo:session): session closed for user root
Sep 11 16:11:34 nativespace-cdp sshd[701580]: Connection closed by 159.100.136.21 port 38986 [preauth]
Sep 11 16:16:37 nativespace-cdp sshd[702982]: Connection closed by 159.100.136.21 port 48828 [preauth]
Sep 11 16:21:36 nativespace-cdp sshd[704249]: Connection closed by 159.100.136.21 port 58200 [preauth]
Sep 11 16:26:33 nativespace-cdp sshd[705566]: Connection closed by 159.100.136.21 port 38548 [preauth]
Sep 11 16:31:34 nativespace-cdp sshd[706834]: Connection closed by 159.100.136.21 port 47486 [preauth]
Sep 11 16:36:34 nativespace-cdp sshd[708186]: Connection closed by 159.100.136.21 port 56956 [preauth]
Sep 11 16:41:33 nativespace-cdp sshd[709634]: Connection closed by 159.100.136.21 port 37944 [preauth]
Sep 11 16:46:33 nativespace-cdp sshd[710942]: Connection closed by 159.100.136.21 port 47228 [preauth]
Sep 11 16:51:33 nativespace-cdp sshd[712046]: Connection closed by 159.100.136.21 port 56064 [preauth]
Sep 11 16:53:25 nativespace-cdp sshd[712329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.141.120.23  user=root
Sep 11 16:53:25 nativespace-cdp sshd[712329]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 16:53:27 nativespace-cdp sshd[712329]: Failed password for root from 94.141.120.23 port 16958 ssh2
Sep 11 16:53:29 nativespace-cdp sshd[712329]: Connection closed by 94.141.120.23 port 16958 [preauth]
Sep 11 16:56:35 nativespace-cdp sshd[713364]: Connection closed by 159.100.136.21 port 37476 [preauth]
Sep 11 16:57:40 nativespace-cdp sshd[713488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.141.120.23  user=root
Sep 11 16:57:40 nativespace-cdp sshd[713488]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 16:57:41 nativespace-cdp sshd[713488]: Failed password for root from 94.141.120.23 port 17986 ssh2
Sep 11 16:57:46 nativespace-cdp sshd[713488]: Connection closed by 94.141.120.23 port 17986 [preauth]
Sep 11 17:01:33 nativespace-cdp sshd[715010]: Connection closed by 159.100.136.21 port 46506 [preauth]
Sep 11 17:01:50 nativespace-cdp sshd[715024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.141.120.23  user=root
Sep 11 17:01:50 nativespace-cdp sshd[715024]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 17:01:51 nativespace-cdp sshd[715024]: Failed password for root from 94.141.120.23 port 10440 ssh2
Sep 11 17:06:33 nativespace-cdp sshd[716334]: Connection closed by 159.100.136.21 port 56280 [preauth]
Sep 11 17:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 17:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:09:56 nativespace-cdp sudo[717039]: pam_unix(sudo:session): session closed for user root
Sep 11 17:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 17:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:09:56 nativespace-cdp sudo[717044]: pam_unix(sudo:session): session closed for user root
Sep 11 17:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 17:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:09:58 nativespace-cdp sudo[717049]: pam_unix(sudo:session): session closed for user root
Sep 11 17:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 17:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:09:58 nativespace-cdp sudo[717063]: pam_unix(sudo:session): session closed for user root
Sep 11 17:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 17:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:00 nativespace-cdp sudo[717069]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:00 nativespace-cdp sudo[717089]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:00 nativespace-cdp sudo[717094]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:01 nativespace-cdp sudo[717098]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 17:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:01 nativespace-cdp sudo[717104]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 17:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:01 nativespace-cdp sudo[717109]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 17:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:01 nativespace-cdp sudo[717135]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 17:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:06 nativespace-cdp sudo[717251]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 17:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:06 nativespace-cdp sudo[717256]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=careers user-2=nbhavers user-3=david user-4=mcdermos user-5=chrisdal user-6=jennimil user-7=tomandle user-8=romaldki user-9=branko user-10=ranxterc user-11=hodgsonmail user-12=outdoorc user-13=onlycont user-14=attlebor user-15=lucy user-16=sosevalu user-17=crrtipdl user-18=bakery user-19=boldover user-20=nove user-21=design user-22=kategilpin user-23=ladburyp user-24=stagingerris user-25=dancinggardener user-26=nvihkvu user-27=sketchy user-28=cath user-29=havantho user-30=what user-31=tstardom user-32=oubpgvbx user-33=steve user-34=zebrapho user-35=bwppodcast user-36=asandcoc user-37=sibtoncc user-38=dhyana user-39=eatspam user-40=darkstar user-41=beauty user-42=nsceres user-43=burydropin user-44=fawcettd user-45=barbersh user-46=tigerlet user-47=hidden user-48=nomistakes user-49=smrszyqg
Sep 11 17:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=isleofwi user-51=philmcph user-52=ctedorgu user-53=firstre5 user-54=steakbridieme user-55=donnychicago user-56=lkpier user-57=fortunaz user-58=health2045 user-59=leftie user-60=foods user-61=putterfc user-62=nscdp user-63=courseme user-64=eugincou user-65=hirefootballgame user-66=paulmca1 user-67=pugwash user-68=howardon user-69=cwsocial user-70=reliable user-71=ninejimm user-72=cambria1 user-73=cathski user-74=southlon user-75=highlegh user-76=firstred user-77=costestimatorco user-78=clarkass user-79=firstrel user-80=opaiscyx user-81=coursemc user-82=firstres user-83=seftvta user-84=jonhartl user-85=ultbcrra user-86=thqkgnbz user-87=connectedshoppin user-88=ianrayne user-89=accooper user-90=carsinyo user-91=fetch user-92=hubmaster user-93=putterfi user-94=elecleis user-95=milloyco user-96=gilpin user-97=bemadonn user-98=belle user-99=ggaaorgu user-100=newstoda user-101=bedfords user-102=battlere
Sep 11 17:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=oneoarco user-104=firstre2 user-105=vivienn1 user-106=brighto1 user-107=nstriton user-108=nativene user-109=askhform user-110=stuartge user-111=innovat1 user-112=skyfirec user-113=alexadmin user-114=ulsukarm user-115=maflemin user-116=lbscrmod user-117=athenare user-118=connect9 user-119=vantagep user-120=foundation user-121=booff user-122=markward user-123=leereyn1 user-124=stephani user-125=still user-126=agproduc user-127=theblack user-128=hodgesonweb user-129=spectrum user-130=jarvisin user-131=musorguk user-132=megacards user-133=wilsonsw user-134=sarafoundation user-135=atestord user-136=strathar user-137=lakesan1 user-138=brmrjxl user-139=magichat user-140=lbhyisi user-141=hhdugcor user-142=ptkxhsbt user-143=dickemery123 user-144=martsblo feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 17:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 17:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:08 nativespace-cdp sudo[717262]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 17:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:08 nativespace-cdp sudo[717270]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ZeF9mVrVB0PDFbS6.~
Sep 11 17:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:08 nativespace-cdp sudo[717274]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ZeF9mVrVB0PDFbS6.~'
Sep 11 17:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:09 nativespace-cdp sudo[717277]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ZeF9mVrVB0PDFbS6.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:09 nativespace-cdp sudo[717281]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 17:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:09 nativespace-cdp sudo[717284]: pam_unix(sudo:session): session closed for user root
Sep 11 17:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 17:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 17:10:11 nativespace-cdp sudo[717303]: pam_unix(sudo:session): session closed for user root
Sep 11 17:11:33 nativespace-cdp sshd[717895]: Connection closed by 159.100.136.21 port 37034 [preauth]
Sep 11 17:16:35 nativespace-cdp sshd[719339]: Connection closed by 159.100.136.21 port 46592 [preauth]
Sep 11 17:21:33 nativespace-cdp sshd[720525]: Connection closed by 159.100.136.21 port 55818 [preauth]
Sep 11 17:26:33 nativespace-cdp sshd[721724]: Connection closed by 159.100.136.21 port 37440 [preauth]
Sep 11 17:31:35 nativespace-cdp sshd[723318]: Connection closed by 159.100.136.21 port 46650 [preauth]
Sep 11 17:36:33 nativespace-cdp sshd[724630]: Connection closed by 159.100.136.21 port 56218 [preauth]
Sep 11 17:41:33 nativespace-cdp sshd[725863]: Connection closed by 159.100.136.21 port 37080 [preauth]
Sep 11 17:46:33 nativespace-cdp sshd[727483]: Connection closed by 159.100.136.21 port 46408 [preauth]
Sep 11 17:51:33 nativespace-cdp sshd[728576]: Connection closed by 159.100.136.21 port 55416 [preauth]
Sep 11 17:56:33 nativespace-cdp sshd[729799]: Connection closed by 159.100.136.21 port 36316 [preauth]
Sep 11 18:01:33 nativespace-cdp sshd[731764]: Connection closed by 159.100.136.21 port 44868 [preauth]
Sep 11 18:06:35 nativespace-cdp sshd[733186]: Connection closed by 159.100.136.21 port 53058 [preauth]
Sep 11 18:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 18:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:50 nativespace-cdp sudo[733889]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 18:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:50 nativespace-cdp sudo[733893]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 18:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:51 nativespace-cdp sudo[733899]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 18:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:51 nativespace-cdp sudo[733907]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 18:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:54 nativespace-cdp sudo[733913]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:54 nativespace-cdp sudo[733925]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:54 nativespace-cdp sudo[733930]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:54 nativespace-cdp sudo[733934]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:54 nativespace-cdp sudo[733939]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:54 nativespace-cdp sudo[733945]: pam_unix(sudo:session): session closed for user root
Sep 11 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:09:54 nativespace-cdp sudo[733952]: pam_unix(sudo:session): session closed for user root
Sep 11 18:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 18:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:10:07 nativespace-cdp sudo[734102]: pam_unix(sudo:session): session closed for user root
Sep 11 18:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 18:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:10:07 nativespace-cdp sudo[734107]: pam_unix(sudo:session): session closed for user root
Sep 11 18:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=maflemin user-3=lbscrmod user-4=athenare user-5=connect9 user-6=vantagep user-7=booff user-8=markward user-9=foundation user-10=leereyn1 user-11=stephani user-12=still user-13=agproduc user-14=theblack user-15=hodgesonweb user-16=spectrum user-17=jarvisin user-18=musorguk user-19=megacards user-20=wilsonsw user-21=sarafoundation user-22=atestord user-23=strathar user-24=brmrjxl user-25=lakesan1 user-26=magichat user-27=lbhyisi user-28=hhdugcor user-29=ptkxhsbt user-30=dickemery123 user-31=martsblo user-32=southlon user-33=highlegh user-34=firstred user-35=costestimatorco user-36=clarkass user-37=firstrel user-38=opaiscyx user-39=coursemc user-40=firstres user-41=jonhartl user-42=seftvta user-43=ultbcrra user-44=thqkgnbz user-45=connectedshoppin user-46=ianrayne user-47=accooper
Sep 11 18:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=carsinyo user-49=fetch user-50=putterfi user-51=hubmaster user-52=elecleis user-53=gilpin user-54=milloyco user-55=bemadonn user-56=belle user-57=ggaaorgu user-58=newstoda user-59=bedfords user-60=battlere user-61=oneoarco user-62=firstre2 user-63=vivienn1 user-64=brighto1 user-65=nstriton user-66=nativene user-67=askhform user-68=stuartge user-69=innovat1 user-70=alexadmin user-71=skyfirec user-72=steve user-73=zebrapho user-74=bwppodcast user-75=sibtoncc user-76=asandcoc user-77=dhyana user-78=eatspam user-79=darkstar user-80=beauty user-81=nsceres user-82=burydropin user-83=fawcettd user-84=barbersh user-85=tigerlet user-86=hidden user-87=nomistakes user-88=isleofwi user-89=smrszyqg user-90=ctedorgu user-91=philmcph user-92=firstre5 user-93=steakbridieme user-94=donnychicago user-95=lkpier user-96=fortunaz user-97=health2045 user-98=leftie user-99=foods user-100=putterfc user-101=nscdp
Sep 11 18:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=courseme user-103=eugincou user-104=hirefootballgame user-105=pugwash user-106=paulmca1 user-107=howardon user-108=cwsocial user-109=reliable user-110=ninejimm user-111=cambria1 user-112=cathski user-113=careers user-114=nbhavers user-115=david user-116=mcdermos user-117=chrisdal user-118=jennimil user-119=tomandle user-120=romaldki user-121=branko user-122=outdoorc user-123=ranxterc user-124=hodgsonmail user-125=onlycont user-126=attlebor user-127=lucy user-128=sosevalu user-129=crrtipdl user-130=bakery user-131=boldover user-132=nove user-133=design user-134=kategilpin user-135=ladburyp user-136=dancinggardener user-137=stagingerris user-138=nvihkvu user-139=sketchy user-140=cath user-141=havantho user-142=what user-143=oubpgvbx user-144=tstardom feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 18:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 18:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:10:08 nativespace-cdp sudo[734111]: pam_unix(sudo:session): session closed for user root
Sep 11 18:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 18:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:10:09 nativespace-cdp sudo[734124]: pam_unix(sudo:session): session closed for user root
Sep 11 18:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Y51j7XugITwh7P4f.~
Sep 11 18:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:10:09 nativespace-cdp sudo[734129]: pam_unix(sudo:session): session closed for user root
Sep 11 18:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Y51j7XugITwh7P4f.~'
Sep 11 18:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:10:09 nativespace-cdp sudo[734132]: pam_unix(sudo:session): session closed for user root
Sep 11 18:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Y51j7XugITwh7P4f.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 18:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:10:09 nativespace-cdp sudo[734138]: pam_unix(sudo:session): session closed for user root
Sep 11 18:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 18:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:10:09 nativespace-cdp sudo[734141]: pam_unix(sudo:session): session closed for user root
Sep 11 18:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 18:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:10:11 nativespace-cdp sudo[734168]: pam_unix(sudo:session): session closed for user root
Sep 11 18:11:33 nativespace-cdp sshd[734678]: Connection closed by 159.100.136.21 port 33492 [preauth]
Sep 11 18:16:36 nativespace-cdp sshd[736240]: Connection closed by 159.100.136.21 port 42884 [preauth]
Sep 11 18:21:33 nativespace-cdp sshd[737393]: Connection closed by 159.100.136.21 port 52094 [preauth]
Sep 11 18:26:34 nativespace-cdp sshd[738600]: Connection closed by 159.100.136.21 port 60630 [preauth]
Sep 11 18:31:33 nativespace-cdp sshd[739875]: Connection closed by 159.100.136.21 port 41260 [preauth]
Sep 11 18:34:49 nativespace-cdp sshd[740653]: Invalid user xt from 103.146.50.230 port 41296
Sep 11 18:34:49 nativespace-cdp sshd[740653]: input_userauth_request: invalid user xt [preauth]
Sep 11 18:34:50 nativespace-cdp sshd[740653]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:34:50 nativespace-cdp sshd[740653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.50.230
Sep 11 18:34:52 nativespace-cdp sshd[740653]: Failed password for invalid user xt from 103.146.50.230 port 41296 ssh2
Sep 11 18:34:52 nativespace-cdp sshd[740653]: Received disconnect from 103.146.50.230 port 41296:11: Bye Bye [preauth]
Sep 11 18:34:52 nativespace-cdp sshd[740653]: Disconnected from 103.146.50.230 port 41296 [preauth]
Sep 11 18:36:35 nativespace-cdp sshd[741263]: Connection closed by 159.100.136.21 port 50350 [preauth]
Sep 11 18:39:15 nativespace-cdp sshd[741950]: Invalid user nik from 117.102.82.13 port 41518
Sep 11 18:39:15 nativespace-cdp sshd[741950]: input_userauth_request: invalid user nik [preauth]
Sep 11 18:39:15 nativespace-cdp sshd[741950]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:39:15 nativespace-cdp sshd[741950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.102.82.13
Sep 11 18:39:17 nativespace-cdp sshd[741950]: Failed password for invalid user nik from 117.102.82.13 port 41518 ssh2
Sep 11 18:39:17 nativespace-cdp sshd[741950]: Received disconnect from 117.102.82.13 port 41518:11: Bye Bye [preauth]
Sep 11 18:39:17 nativespace-cdp sshd[741950]: Disconnected from 117.102.82.13 port 41518 [preauth]
Sep 11 18:40:25 nativespace-cdp sshd[742443]: Invalid user ubuntu from 152.32.234.201 port 48766
Sep 11 18:40:25 nativespace-cdp sshd[742443]: input_userauth_request: invalid user ubuntu [preauth]
Sep 11 18:40:25 nativespace-cdp sshd[742443]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:40:25 nativespace-cdp sshd[742443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.234.201
Sep 11 18:40:26 nativespace-cdp sshd[742446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.238.254.34  user=root
Sep 11 18:40:26 nativespace-cdp sshd[742446]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 18:40:28 nativespace-cdp sshd[742443]: Failed password for invalid user ubuntu from 152.32.234.201 port 48766 ssh2
Sep 11 18:40:28 nativespace-cdp sshd[742443]: Received disconnect from 152.32.234.201 port 48766:11: Bye Bye [preauth]
Sep 11 18:40:28 nativespace-cdp sshd[742443]: Disconnected from 152.32.234.201 port 48766 [preauth]
Sep 11 18:40:29 nativespace-cdp sshd[742446]: Failed password for root from 47.238.254.34 port 55448 ssh2
Sep 11 18:40:32 nativespace-cdp sshd[742446]: Received disconnect from 47.238.254.34 port 55448:11: Bye Bye [preauth]
Sep 11 18:40:32 nativespace-cdp sshd[742446]: Disconnected from 47.238.254.34 port 55448 [preauth]
Sep 11 18:41:34 nativespace-cdp sshd[742860]: Connection closed by 159.100.136.21 port 59896 [preauth]
Sep 11 18:42:27 nativespace-cdp sshd[743319]: Invalid user arash from 47.238.254.34 port 40860
Sep 11 18:42:27 nativespace-cdp sshd[743319]: input_userauth_request: invalid user arash [preauth]
Sep 11 18:42:27 nativespace-cdp sshd[743319]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:42:27 nativespace-cdp sshd[743319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.238.254.34
Sep 11 18:42:28 nativespace-cdp sshd[743319]: Failed password for invalid user arash from 47.238.254.34 port 40860 ssh2
Sep 11 18:42:32 nativespace-cdp sshd[743319]: Received disconnect from 47.238.254.34 port 40860:11: Bye Bye [preauth]
Sep 11 18:42:32 nativespace-cdp sshd[743319]: Disconnected from 47.238.254.34 port 40860 [preauth]
Sep 11 18:42:34 nativespace-cdp sshd[743336]: Invalid user hangs from 117.102.82.13 port 48208
Sep 11 18:42:34 nativespace-cdp sshd[743336]: input_userauth_request: invalid user hangs [preauth]
Sep 11 18:42:34 nativespace-cdp sshd[743336]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:42:34 nativespace-cdp sshd[743336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.102.82.13
Sep 11 18:42:35 nativespace-cdp sshd[743336]: Failed password for invalid user hangs from 117.102.82.13 port 48208 ssh2
Sep 11 18:42:36 nativespace-cdp sshd[743336]: Received disconnect from 117.102.82.13 port 48208:11: Bye Bye [preauth]
Sep 11 18:42:36 nativespace-cdp sshd[743336]: Disconnected from 117.102.82.13 port 48208 [preauth]
Sep 11 18:42:47 nativespace-cdp sshd[743407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.50.230  user=root
Sep 11 18:42:47 nativespace-cdp sshd[743407]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 18:42:49 nativespace-cdp sshd[743407]: Failed password for root from 103.146.50.230 port 41652 ssh2
Sep 11 18:42:49 nativespace-cdp sshd[743407]: Received disconnect from 103.146.50.230 port 41652:11: Bye Bye [preauth]
Sep 11 18:42:49 nativespace-cdp sshd[743407]: Disconnected from 103.146.50.230 port 41652 [preauth]
Sep 11 18:43:07 nativespace-cdp sshd[743483]: Connection closed by 47.238.254.34 port 45584 [preauth]
Sep 11 18:43:16 nativespace-cdp sshd[743510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.102.82.13  user=root
Sep 11 18:43:16 nativespace-cdp sshd[743510]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 18:43:18 nativespace-cdp sshd[743510]: Failed password for root from 117.102.82.13 port 53058 ssh2
Sep 11 18:43:21 nativespace-cdp sshd[743510]: Received disconnect from 117.102.82.13 port 53058:11: Bye Bye [preauth]
Sep 11 18:43:21 nativespace-cdp sshd[743510]: Disconnected from 117.102.82.13 port 53058 [preauth]
Sep 11 18:43:37 nativespace-cdp sshd[743605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.238.254.34  user=root
Sep 11 18:43:37 nativespace-cdp sshd[743605]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 18:43:37 nativespace-cdp sshd[743609]: Connection closed by 103.146.50.230 port 55892 [preauth]
Sep 11 18:43:37 nativespace-cdp sshd[743574]: Invalid user zp from 208.115.223.235 port 53192
Sep 11 18:43:37 nativespace-cdp sshd[743574]: input_userauth_request: invalid user zp [preauth]
Sep 11 18:43:37 nativespace-cdp sshd[743574]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:43:37 nativespace-cdp sshd[743574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.115.223.235
Sep 11 18:43:39 nativespace-cdp sshd[743605]: Failed password for root from 47.238.254.34 port 50304 ssh2
Sep 11 18:43:39 nativespace-cdp sshd[743574]: Failed password for invalid user zp from 208.115.223.235 port 53192 ssh2
Sep 11 18:43:42 nativespace-cdp sshd[743574]: Received disconnect from 208.115.223.235 port 53192:11: Bye Bye [preauth]
Sep 11 18:43:42 nativespace-cdp sshd[743574]: Disconnected from 208.115.223.235 port 53192 [preauth]
Sep 11 18:44:19 nativespace-cdp sshd[743842]: Invalid user rajesh from 103.146.50.230 port 59680
Sep 11 18:44:19 nativespace-cdp sshd[743842]: input_userauth_request: invalid user rajesh [preauth]
Sep 11 18:44:19 nativespace-cdp sshd[743842]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:44:19 nativespace-cdp sshd[743842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.50.230
Sep 11 18:44:21 nativespace-cdp sshd[743842]: Failed password for invalid user rajesh from 103.146.50.230 port 59680 ssh2
Sep 11 18:44:21 nativespace-cdp sshd[743842]: Received disconnect from 103.146.50.230 port 59680:11: Bye Bye [preauth]
Sep 11 18:44:21 nativespace-cdp sshd[743842]: Disconnected from 103.146.50.230 port 59680 [preauth]
Sep 11 18:44:40 nativespace-cdp sshd[743905]: Invalid user tuser from 152.32.234.201 port 54372
Sep 11 18:44:40 nativespace-cdp sshd[743905]: input_userauth_request: invalid user tuser [preauth]
Sep 11 18:44:40 nativespace-cdp sshd[743905]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:44:40 nativespace-cdp sshd[743905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.234.201
Sep 11 18:44:42 nativespace-cdp sshd[743905]: Failed password for invalid user tuser from 152.32.234.201 port 54372 ssh2
Sep 11 18:44:42 nativespace-cdp sshd[743905]: Received disconnect from 152.32.234.201 port 54372:11: Bye Bye [preauth]
Sep 11 18:44:42 nativespace-cdp sshd[743905]: Disconnected from 152.32.234.201 port 54372 [preauth]
Sep 11 18:45:41 nativespace-cdp sshd[744219]: Invalid user yuli from 208.115.223.235 port 33590
Sep 11 18:45:41 nativespace-cdp sshd[744219]: input_userauth_request: invalid user yuli [preauth]
Sep 11 18:45:41 nativespace-cdp sshd[744219]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:45:41 nativespace-cdp sshd[744219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.115.223.235
Sep 11 18:45:43 nativespace-cdp sshd[744219]: Failed password for invalid user yuli from 208.115.223.235 port 33590 ssh2
Sep 11 18:45:43 nativespace-cdp sshd[744219]: Received disconnect from 208.115.223.235 port 33590:11: Bye Bye [preauth]
Sep 11 18:45:43 nativespace-cdp sshd[744219]: Disconnected from 208.115.223.235 port 33590 [preauth]
Sep 11 18:46:23 nativespace-cdp sshd[744370]: Invalid user nuevo from 208.115.223.235 port 39648
Sep 11 18:46:23 nativespace-cdp sshd[744370]: input_userauth_request: invalid user nuevo [preauth]
Sep 11 18:46:23 nativespace-cdp sshd[744370]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:46:23 nativespace-cdp sshd[744370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.115.223.235
Sep 11 18:46:25 nativespace-cdp sshd[744370]: Failed password for invalid user nuevo from 208.115.223.235 port 39648 ssh2
Sep 11 18:46:35 nativespace-cdp sshd[744425]: Connection closed by 159.100.136.21 port 41052 [preauth]
Sep 11 18:46:35 nativespace-cdp sshd[744338]: Connection closed by 152.32.234.201 port 37042 [preauth]
Sep 11 18:48:07 nativespace-cdp sshd[744641]: Connection closed by 152.32.234.201 port 60736 [preauth]
Sep 11 18:49:24 nativespace-cdp sshd[744990]: Connection closed by 152.32.234.201 port 42250 [preauth]
Sep 11 18:51:36 nativespace-cdp sshd[745586]: Connection closed by 159.100.136.21 port 50346 [preauth]
Sep 11 18:53:41 nativespace-cdp sshd[745934]: Connection closed by 152.32.234.201 port 59654 [preauth]
Sep 11 18:54:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cpapi2 --user=bakery Locale get_user_locale --output=json
Sep 11 18:54:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:54:33 nativespace-cdp sudo[746224]: pam_unix(sudo:session): session closed for user root
Sep 11 18:54:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 18:54:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:54:34 nativespace-cdp sudo[746234]: pam_unix(sudo:session): session closed for user root
Sep 11 18:54:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 18:54:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:54:34 nativespace-cdp sudo[746241]: pam_unix(sudo:session): session closed for user root
Sep 11 18:55:08 nativespace-cdp sshd[746450]: Invalid user jin from 152.32.234.201 port 46284
Sep 11 18:55:08 nativespace-cdp sshd[746450]: input_userauth_request: invalid user jin [preauth]
Sep 11 18:55:08 nativespace-cdp sshd[746450]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 18:55:08 nativespace-cdp sshd[746450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.234.201
Sep 11 18:55:10 nativespace-cdp sshd[746450]: Failed password for invalid user jin from 152.32.234.201 port 46284 ssh2
Sep 11 18:55:13 nativespace-cdp sshd[746450]: Received disconnect from 152.32.234.201 port 46284:11: Bye Bye [preauth]
Sep 11 18:55:13 nativespace-cdp sshd[746450]: Disconnected from 152.32.234.201 port 46284 [preauth]
Sep 11 18:56:33 nativespace-cdp sshd[746827]: Connection closed by 159.100.136.21 port 59462 [preauth]
Sep 11 18:58:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cpapi2 --user=bakery Locale get_user_locale --output=json
Sep 11 18:58:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:58:26 nativespace-cdp sudo[747343]: pam_unix(sudo:session): session closed for user root
Sep 11 18:58:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 18:58:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:58:27 nativespace-cdp sudo[747349]: pam_unix(sudo:session): session closed for user root
Sep 11 18:58:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 18:58:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 18:58:27 nativespace-cdp sudo[747355]: pam_unix(sudo:session): session closed for user root
Sep 11 19:01:33 nativespace-cdp sshd[748687]: Connection closed by 159.100.136.21 port 40446 [preauth]
Sep 11 19:06:34 nativespace-cdp sshd[749919]: Connection closed by 159.100.136.21 port 48932 [preauth]
Sep 11 19:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 19:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:50 nativespace-cdp sudo[750593]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 19:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:50 nativespace-cdp sudo[750598]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 19:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:51 nativespace-cdp sudo[750603]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 19:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:51 nativespace-cdp sudo[750609]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 19:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:54 nativespace-cdp sudo[750617]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:54 nativespace-cdp sudo[750652]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:54 nativespace-cdp sudo[750657]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:54 nativespace-cdp sudo[750661]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 19:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:55 nativespace-cdp sudo[750666]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 19:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:55 nativespace-cdp sudo[750672]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 19:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:55 nativespace-cdp sudo[750677]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:57 nativespace-cdp sudo[750697]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 19:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:57 nativespace-cdp sudo[750704]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=wilsonsw user-2=musorguk user-3=megacards user-4=brmrjxl user-5=lakesan1 user-6=sarafoundation user-7=atestord user-8=strathar user-9=lbhyisi user-10=hhdugcor user-11=magichat user-12=martsblo user-13=ptkxhsbt user-14=dickemery123 user-15=ulsukarm user-16=foundation user-17=booff user-18=markward user-19=maflemin user-20=lbscrmod user-21=athenare user-22=connect9 user-23=vantagep user-24=still user-25=agproduc user-26=leereyn1 user-27=stephani user-28=jarvisin user-29=hodgesonweb user-30=theblack user-31=spectrum user-32=bedfords user-33=bemadonn user-34=ggaaorgu user-35=belle user-36=newstoda user-37=brighto1 user-38=nstriton user-39=battlere user-40=oneoarco user-41=firstre2 user-42=vivienn1 user-43=stuartge user-44=askhform user-45=innovat1 user-46=nativene user-47=alexadmin user-48=skyfirec
Sep 11 19:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=southlon user-53=highlegh user-54=firstred user-55=firstres user-56=seftvta user-57=jonhartl user-58=ultbcrra user-59=coursemc user-60=opaiscyx user-61=ianrayne user-62=accooper user-63=thqkgnbz user-64=connectedshoppin user-65=elecleis user-66=milloyco user-67=gilpin user-68=carsinyo user-69=fetch user-70=hubmaster user-71=putterfi user-72=isleofwi user-73=smrszyqg user-74=tigerlet user-75=barbersh user-76=hidden user-77=nomistakes user-78=fortunaz user-79=health2045 user-80=foods user-81=leftie user-82=putterfc user-83=nscdp user-84=ctedorgu user-85=philmcph user-86=firstre5 user-87=donnychicago user-88=steakbridieme user-89=lkpier user-90=hirefootballgame user-91=courseme user-92=eugincou user-93=reliable user-94=ninejimm user-95=cambria1 user-96=cathski user-97=paulmca1 user-98=howardon user-99=pugwash user-100=cwsocial user-101=zebrapho
Sep 11 19:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=bwppodcast user-103=steve user-104=sibtoncc user-105=asandcoc user-106=eatspam user-107=darkstar user-108=beauty user-109=dhyana user-110=burydropin user-111=fawcettd user-112=nsceres user-113=sosevalu user-114=crrtipdl user-115=bakery user-116=nove user-117=boldover user-118=kategilpin user-119=ladburyp user-120=dancinggardener user-121=stagingerris user-122=design user-123=what user-124=oubpgvbx user-125=tstardom user-126=nvihkvu user-127=cath user-128=sketchy user-129=havantho user-130=mcdermos user-131=chrisdal user-132=careers user-133=nbhavers user-134=david user-135=tomandle user-136=jennimil user-137=branko user-138=ranxterc user-139=hodgsonmail user-140=outdoorc user-141=romaldki user-142=attlebor user-143=lucy user-144=onlycont feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 19:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 19:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:57 nativespace-cdp sudo[750711]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 19:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:58 nativespace-cdp sudo[750720]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Lruq8IznRnaNM3px.~
Sep 11 19:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:58 nativespace-cdp sudo[750725]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Lruq8IznRnaNM3px.~'
Sep 11 19:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:58 nativespace-cdp sudo[750729]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Lruq8IznRnaNM3px.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 19:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:58 nativespace-cdp sudo[750735]: pam_unix(sudo:session): session closed for user root
Sep 11 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 19:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:09:58 nativespace-cdp sudo[750740]: pam_unix(sudo:session): session closed for user root
Sep 11 19:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 19:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:10:19 nativespace-cdp sudo[750994]: pam_unix(sudo:session): session closed for user root
Sep 11 19:11:33 nativespace-cdp sshd[751558]: Connection closed by 159.100.136.21 port 57436 [preauth]
Sep 11 19:15:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cpapi2 --user=bakery Locale get_user_locale --output=json
Sep 11 19:15:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:15:41 nativespace-cdp sudo[752844]: pam_unix(sudo:session): session closed for user root
Sep 11 19:15:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 19:15:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:15:41 nativespace-cdp sudo[752851]: pam_unix(sudo:session): session closed for user root
Sep 11 19:15:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 19:15:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 19:15:41 nativespace-cdp sudo[752860]: pam_unix(sudo:session): session closed for user root
Sep 11 19:16:34 nativespace-cdp sshd[753060]: Connection closed by 159.100.136.21 port 38346 [preauth]
Sep 11 19:21:34 nativespace-cdp sshd[754158]: Connection closed by 159.100.136.21 port 47138 [preauth]
Sep 11 19:26:33 nativespace-cdp sshd[755535]: Connection closed by 159.100.136.21 port 56172 [preauth]
Sep 11 19:31:33 nativespace-cdp sshd[756690]: Connection closed by 159.100.136.21 port 37642 [preauth]
Sep 11 19:36:33 nativespace-cdp sshd[757943]: Connection closed by 159.100.136.21 port 47268 [preauth]
Sep 11 19:41:33 nativespace-cdp sshd[759479]: Connection closed by 159.100.136.21 port 55152 [preauth]
Sep 11 19:46:36 nativespace-cdp sshd[760754]: Connection closed by 159.100.136.21 port 36376 [preauth]
Sep 11 19:51:33 nativespace-cdp sshd[761886]: Connection closed by 159.100.136.21 port 45596 [preauth]
Sep 11 19:56:33 nativespace-cdp sshd[763196]: Connection closed by 159.100.136.21 port 54948 [preauth]
Sep 11 20:01:36 nativespace-cdp sshd[764794]: Connection closed by 159.100.136.21 port 35362 [preauth]
Sep 11 20:06:33 nativespace-cdp sshd[765836]: Connection closed by 159.100.136.21 port 42942 [preauth]
Sep 11 20:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 20:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:50 nativespace-cdp sudo[766398]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 20:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:50 nativespace-cdp sudo[766403]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 20:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:51 nativespace-cdp sudo[766408]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 20:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:51 nativespace-cdp sudo[766415]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 20:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:54 nativespace-cdp sudo[766421]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:54 nativespace-cdp sudo[766439]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:54 nativespace-cdp sudo[766445]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:54 nativespace-cdp sudo[766448]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:54 nativespace-cdp sudo[766456]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:54 nativespace-cdp sudo[766465]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:54 nativespace-cdp sudo[766476]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 20:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:56 nativespace-cdp sudo[766564]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 20:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:57 nativespace-cdp sudo[766570]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=agproduc user-2=still user-3=stephani user-4=leereyn1 user-5=jarvisin user-6=spectrum user-7=theblack user-8=hodgesonweb user-9=ulsukarm user-10=booff user-11=markward user-12=foundation user-13=vantagep user-14=connect9 user-15=athenare user-16=lbscrmod user-17=maflemin user-18=hhdugcor user-19=lbhyisi user-20=magichat user-21=martsblo user-22=dickemery123 user-23=ptkxhsbt user-24=wilsonsw user-25=megacards user-26=musorguk user-27=brmrjxl user-28=lakesan1 user-29=strathar user-30=atestord user-31=sarafoundation user-32=accooper user-33=ianrayne user-34=connectedshoppin user-35=thqkgnbz user-36=gilpin user-37=milloyco user-38=elecleis user-39=hubmaster user-40=putterfi user-41=fetch user-42=carsinyo user-43=firstrel user-44=clarkass user-45=costestimatorco user-46=firstred user-47=highlegh
Sep 11 20:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=southlon user-49=ultbcrra user-50=seftvta user-51=jonhartl user-52=firstres user-53=coursemc user-54=opaiscyx user-55=innovat1 user-56=stuartge user-57=askhform user-58=nativene user-59=skyfirec user-60=alexadmin user-61=bedfords user-62=newstoda user-63=ggaaorgu user-64=belle user-65=bemadonn user-66=nstriton user-67=brighto1 user-68=vivienn1 user-69=firstre2 user-70=oneoarco user-71=battlere user-72=beauty user-73=darkstar user-74=eatspam user-75=dhyana user-76=fawcettd user-77=burydropin user-78=nsceres user-79=bwppodcast user-80=zebrapho user-81=steve user-82=asandcoc user-83=sibtoncc user-84=hirefootballgame user-85=eugincou user-86=courseme user-87=cambria1 user-88=cathski user-89=reliable user-90=ninejimm user-91=cwsocial user-92=howardon user-93=paulmca1 user-94=pugwash user-95=isleofwi user-96=smrszyqg user-97=nomistakes user-98=hidden user-99=tigerlet user-100=barbersh user-101=nscdp
Sep 11 20:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=putterfc user-103=leftie user-104=foods user-105=health2045 user-106=fortunaz user-107=lkpier user-108=donnychicago user-109=firstre5 user-110=steakbridieme user-111=philmcph user-112=ctedorgu user-113=hodgsonmail user-114=ranxterc user-115=outdoorc user-116=branko user-117=romaldki user-118=lucy user-119=attlebor user-120=onlycont user-121=chrisdal user-122=mcdermos user-123=david user-124=careers user-125=nbhavers user-126=tomandle user-127=jennimil user-128=stagingerris user-129=dancinggardener user-130=ladburyp user-131=kategilpin user-132=design user-133=oubpgvbx user-134=tstardom user-135=what user-136=havantho user-137=sketchy user-138=cath user-139=nvihkvu user-140=bakery user-141=crrtipdl user-142=sosevalu user-143=nove user-144=boldover feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 20:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 20:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:57 nativespace-cdp sudo[766577]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:58 nativespace-cdp sudo[766585]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F29p7jUt8ndLSzTk.~
Sep 11 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:58 nativespace-cdp sudo[766590]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F29p7jUt8ndLSzTk.~'
Sep 11 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:58 nativespace-cdp sudo[766594]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-F29p7jUt8ndLSzTk.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:58 nativespace-cdp sudo[766600]: pam_unix(sudo:session): session closed for user root
Sep 11 20:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 20:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:09:58 nativespace-cdp sudo[766605]: pam_unix(sudo:session): session closed for user root
Sep 11 20:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 20:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 20:10:05 nativespace-cdp sudo[766757]: pam_unix(sudo:session): session closed for user root
Sep 11 20:11:33 nativespace-cdp sshd[767312]: Connection closed by 159.100.136.21 port 51984 [preauth]
Sep 11 20:16:33 nativespace-cdp sshd[768674]: Connection closed by 159.100.136.21 port 33174 [preauth]
Sep 11 20:21:33 nativespace-cdp sshd[769942]: Connection closed by 159.100.136.21 port 41888 [preauth]
Sep 11 20:26:35 nativespace-cdp sshd[771160]: Connection closed by 159.100.136.21 port 51020 [preauth]
Sep 11 20:31:34 nativespace-cdp sshd[772735]: Connection closed by 159.100.136.21 port 60164 [preauth]
Sep 11 20:36:34 nativespace-cdp sshd[773925]: Connection closed by 159.100.136.21 port 41818 [preauth]
Sep 11 20:41:35 nativespace-cdp sshd[775331]: Connection closed by 159.100.136.21 port 49064 [preauth]
Sep 11 20:46:33 nativespace-cdp sshd[776522]: Connection closed by 159.100.136.21 port 57270 [preauth]
Sep 11 20:51:34 nativespace-cdp sshd[777840]: Connection closed by 159.100.136.21 port 37902 [preauth]
Sep 11 20:56:33 nativespace-cdp sshd[779869]: Connection closed by 159.100.136.21 port 46276 [preauth]
Sep 11 21:01:33 nativespace-cdp sshd[781160]: Connection closed by 159.100.136.21 port 55506 [preauth]
Sep 11 21:06:33 nativespace-cdp sshd[782661]: Connection closed by 159.100.136.21 port 36720 [preauth]
Sep 11 21:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 21:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:09:57 nativespace-cdp sudo[783260]: pam_unix(sudo:session): session closed for user root
Sep 11 21:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 21:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:09:57 nativespace-cdp sudo[783265]: pam_unix(sudo:session): session closed for user root
Sep 11 21:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 21:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:09:58 nativespace-cdp sudo[783270]: pam_unix(sudo:session): session closed for user root
Sep 11 21:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 21:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:09:59 nativespace-cdp sudo[783278]: pam_unix(sudo:session): session closed for user root
Sep 11 21:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 21:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:01 nativespace-cdp sudo[783284]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:01 nativespace-cdp sudo[783295]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:01 nativespace-cdp sudo[783301]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:01 nativespace-cdp sudo[783305]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:01 nativespace-cdp sudo[783310]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:01 nativespace-cdp sudo[783316]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 21:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:01 nativespace-cdp sudo[783346]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 21:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:06 nativespace-cdp sudo[783453]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 21:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:07 nativespace-cdp sudo[783458]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=leftie user-2=foods user-3=health2045 user-4=fortunaz user-5=nscdp user-6=putterfc user-7=firstre5 user-8=steakbridieme user-9=donnychicago user-10=ctedorgu user-11=philmcph user-12=lkpier user-13=smrszyqg user-14=isleofwi user-15=tigerlet user-16=barbersh user-17=nomistakes user-18=hidden user-19=ninejimm user-20=reliable user-21=cathski user-22=cambria1 user-23=cwsocial user-24=pugwash user-25=paulmca1 user-26=howardon user-27=hirefootballgame user-28=courseme user-29=eugincou user-30=sibtoncc user-31=asandcoc user-32=zebrapho user-33=bwppodcast user-34=steve user-35=fawcettd user-36=burydropin user-37=nsceres user-38=darkstar user-39=eatspam user-40=beauty user-41=dhyana user-42=nove user-43=boldover user-44=crrtipdl user-45=sosevalu user-46=bakery user-47=what user-48=oubpgvbx
Sep 11 21:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=tstardom user-50=nvihkvu user-51=havantho user-52=cath user-53=sketchy user-54=kategilpin user-55=dancinggardener user-56=stagingerris user-57=ladburyp user-58=design user-59=tomandle user-60=jennimil user-61=mcdermos user-62=chrisdal user-63=david user-64=nbhavers user-65=careers user-66=lucy user-67=attlebor user-68=onlycont user-69=branko user-70=hodgsonmail user-71=ranxterc user-72=outdoorc user-73=romaldki user-74=brmrjxl user-75=lakesan1 user-76=atestord user-77=sarafoundation user-78=strathar user-79=wilsonsw user-80=megacards user-81=musorguk user-82=martsblo user-83=ptkxhsbt user-84=dickemery123 user-85=hhdugcor user-86=lbhyisi user-87=magichat user-88=booff user-89=markward user-90=foundation user-91=lbscrmod user-92=maflemin user-93=vantagep user-94=athenare user-95=connect9 user-96=ulsukarm user-97=jarvisin user-98=theblack user-99=hodgesonweb user-100=spectrum user-101=agproduc user-102=still
Sep 11 21:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=leereyn1 user-104=stephani user-105=nstriton user-106=brighto1 user-107=oneoarco user-108=battlere user-109=vivienn1 user-110=firstre2 user-111=bedfords user-112=bemadonn user-113=newstoda user-114=ggaaorgu user-115=belle user-116=skyfirec user-117=alexadmin user-118=askhform user-119=stuartge user-120=innovat1 user-121=nativene user-122=firstres user-123=ultbcrra user-124=jonhartl user-125=seftvta user-126=opaiscyx user-127=coursemc user-128=costestimatorco user-129=firstrel user-130=clarkass user-131=highlegh user-132=southlon user-133=firstred user-134=elecleis user-135=milloyco user-136=gilpin user-137=fetch user-138=carsinyo user-139=hubmaster user-140=putterfi user-141=ianrayne user-142=accooper user-143=thqkgnbz user-144=connectedshoppin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 21:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 21:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:08 nativespace-cdp sudo[783465]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:09 nativespace-cdp sudo[783473]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mlAAzg0r3jTg9I3V.~
Sep 11 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:09 nativespace-cdp sudo[783476]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mlAAzg0r3jTg9I3V.~'
Sep 11 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:09 nativespace-cdp sudo[783479]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-mlAAzg0r3jTg9I3V.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:09 nativespace-cdp sudo[783483]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:09 nativespace-cdp sudo[783486]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep 11 21:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:15 nativespace-cdp sudo[783490]: pam_unix(sudo:session): session closed for user root
Sep 11 21:10:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 21:10:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:10:31 nativespace-cdp sudo[783703]: pam_unix(sudo:session): session closed for user root
Sep 11 21:11:33 nativespace-cdp sshd[784313]: Connection closed by 159.100.136.21 port 44186 [preauth]
Sep 11 21:16:38 nativespace-cdp sshd[785458]: Connection closed by 159.100.136.21 port 53348 [preauth]
Sep 11 21:21:33 nativespace-cdp sshd[786580]: Connection closed by 159.100.136.21 port 33942 [preauth]
Sep 11 21:26:27 nativespace-cdp sshd[787830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.241.104  user=root
Sep 11 21:26:27 nativespace-cdp sshd[787830]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 21:26:29 nativespace-cdp sshd[787830]: Failed password for root from 107.170.241.104 port 37646 ssh2
Sep 11 21:26:29 nativespace-cdp sshd[787830]: Received disconnect from 107.170.241.104 port 37646:11: Bye Bye [preauth]
Sep 11 21:26:29 nativespace-cdp sshd[787830]: Disconnected from 107.170.241.104 port 37646 [preauth]
Sep 11 21:26:34 nativespace-cdp sshd[787852]: Connection closed by 159.100.136.21 port 43478 [preauth]
Sep 11 21:27:38 nativespace-cdp sshd[788091]: Invalid user shlee from 45.140.192.201 port 52786
Sep 11 21:27:38 nativespace-cdp sshd[788091]: input_userauth_request: invalid user shlee [preauth]
Sep 11 21:27:38 nativespace-cdp sshd[788091]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 21:27:38 nativespace-cdp sshd[788091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.140.192.201
Sep 11 21:27:40 nativespace-cdp sshd[788091]: Failed password for invalid user shlee from 45.140.192.201 port 52786 ssh2
Sep 11 21:27:41 nativespace-cdp sshd[788091]: Received disconnect from 45.140.192.201 port 52786:11: Bye Bye [preauth]
Sep 11 21:27:41 nativespace-cdp sshd[788091]: Disconnected from 45.140.192.201 port 52786 [preauth]
Sep 11 21:29:14 nativespace-cdp sshd[788788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.151.128.225  user=root
Sep 11 21:29:14 nativespace-cdp sshd[788788]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 21:29:17 nativespace-cdp sshd[788788]: Failed password for root from 91.151.128.225 port 46866 ssh2
Sep 11 21:29:17 nativespace-cdp sshd[788788]: Received disconnect from 91.151.128.225 port 46866:11: Bye Bye [preauth]
Sep 11 21:29:17 nativespace-cdp sshd[788788]: Disconnected from 91.151.128.225 port 46866 [preauth]
Sep 11 21:29:51 nativespace-cdp sshd[788877]: Invalid user smita from 107.170.241.104 port 39056
Sep 11 21:29:51 nativespace-cdp sshd[788877]: input_userauth_request: invalid user smita [preauth]
Sep 11 21:29:51 nativespace-cdp sshd[788877]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 21:29:51 nativespace-cdp sshd[788877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.241.104
Sep 11 21:29:53 nativespace-cdp sshd[788877]: Failed password for invalid user smita from 107.170.241.104 port 39056 ssh2
Sep 11 21:29:59 nativespace-cdp sshd[788877]: Received disconnect from 107.170.241.104 port 39056:11: Bye Bye [preauth]
Sep 11 21:29:59 nativespace-cdp sshd[788877]: Disconnected from 107.170.241.104 port 39056 [preauth]
Sep 11 21:30:01 nativespace-cdp sshd[788896]: Invalid user candy from 45.140.192.201 port 35350
Sep 11 21:30:01 nativespace-cdp sshd[788896]: input_userauth_request: invalid user candy [preauth]
Sep 11 21:30:01 nativespace-cdp sshd[788896]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 21:30:01 nativespace-cdp sshd[788896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.140.192.201
Sep 11 21:30:03 nativespace-cdp sshd[788896]: Failed password for invalid user candy from 45.140.192.201 port 35350 ssh2
Sep 11 21:30:03 nativespace-cdp sshd[788896]: Received disconnect from 45.140.192.201 port 35350:11: Bye Bye [preauth]
Sep 11 21:30:03 nativespace-cdp sshd[788896]: Disconnected from 45.140.192.201 port 35350 [preauth]
Sep 11 21:30:35 nativespace-cdp sshd[789194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.241.104  user=root
Sep 11 21:30:35 nativespace-cdp sshd[789194]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 11 21:30:37 nativespace-cdp sshd[789194]: Failed password for root from 107.170.241.104 port 51912 ssh2
Sep 11 21:30:38 nativespace-cdp sshd[789194]: Received disconnect from 107.170.241.104 port 51912:11: Bye Bye [preauth]
Sep 11 21:30:38 nativespace-cdp sshd[789194]: Disconnected from 107.170.241.104 port 51912 [preauth]
Sep 11 21:30:39 nativespace-cdp sshd[789289]: Invalid user r00t123 from 91.151.128.225 port 36104
Sep 11 21:30:39 nativespace-cdp sshd[789289]: input_userauth_request: invalid user r00t123 [preauth]
Sep 11 21:30:39 nativespace-cdp sshd[789289]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 21:30:39 nativespace-cdp sshd[789289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.151.128.225
Sep 11 21:30:42 nativespace-cdp sshd[789289]: Failed password for invalid user r00t123 from 91.151.128.225 port 36104 ssh2
Sep 11 21:30:42 nativespace-cdp sshd[789289]: Received disconnect from 91.151.128.225 port 36104:11: Bye Bye [preauth]
Sep 11 21:30:42 nativespace-cdp sshd[789289]: Disconnected from 91.151.128.225 port 36104 [preauth]
Sep 11 21:30:52 nativespace-cdp sshd[789320]: Invalid user temp from 45.140.192.201 port 36022
Sep 11 21:30:52 nativespace-cdp sshd[789320]: input_userauth_request: invalid user temp [preauth]
Sep 11 21:30:52 nativespace-cdp sshd[789320]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 21:30:52 nativespace-cdp sshd[789320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.140.192.201
Sep 11 21:30:53 nativespace-cdp sshd[789320]: Failed password for invalid user temp from 45.140.192.201 port 36022 ssh2
Sep 11 21:31:33 nativespace-cdp sshd[789536]: Connection closed by 159.100.136.21 port 52738 [preauth]
Sep 11 21:31:48 nativespace-cdp sshd[789602]: Invalid user kodiak from 91.151.128.225 port 49734
Sep 11 21:31:48 nativespace-cdp sshd[789602]: input_userauth_request: invalid user kodiak [preauth]
Sep 11 21:31:48 nativespace-cdp sshd[789602]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 21:31:48 nativespace-cdp sshd[789602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.151.128.225
Sep 11 21:31:50 nativespace-cdp sshd[789602]: Failed password for invalid user kodiak from 91.151.128.225 port 49734 ssh2
Sep 11 21:31:50 nativespace-cdp sshd[789602]: Received disconnect from 91.151.128.225 port 49734:11: Bye Bye [preauth]
Sep 11 21:31:50 nativespace-cdp sshd[789602]: Disconnected from 91.151.128.225 port 49734 [preauth]
Sep 11 21:36:33 nativespace-cdp sshd[791696]: Connection closed by 159.100.136.21 port 34004 [preauth]
Sep 11 21:41:33 nativespace-cdp sshd[793122]: Connection closed by 159.100.136.21 port 42952 [preauth]
Sep 11 21:46:33 nativespace-cdp sshd[794326]: Connection closed by 159.100.136.21 port 51638 [preauth]
Sep 11 21:51:33 nativespace-cdp sshd[795471]: Connection closed by 159.100.136.21 port 60940 [preauth]
Sep 11 21:55:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 21:55:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:55:11 nativespace-cdp sudo[796295]: pam_unix(sudo:session): session closed for user root
Sep 11 21:55:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status athenare
Sep 11 21:55:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:55:13 nativespace-cdp sudo[796301]: pam_unix(sudo:session): session closed for user root
Sep 11 21:55:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 21:55:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:55:19 nativespace-cdp sudo[796391]: pam_unix(sudo:session): session closed for user root
Sep 11 21:55:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status health2045
Sep 11 21:55:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:55:20 nativespace-cdp sudo[796396]: pam_unix(sudo:session): session closed for user root
Sep 11 21:55:58 nativespace-cdp sshd[796893]: Bad protocol version identification '\003' from 91.238.181.33 port 65260
Sep 11 21:56:35 nativespace-cdp sshd[797209]: Connection closed by 159.100.136.21 port 42058 [preauth]
Sep 11 21:57:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 21:57:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:08 nativespace-cdp sudo[797533]: pam_unix(sudo:session): session closed for user root
Sep 11 21:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status nvihkvu
Sep 11 21:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:13 nativespace-cdp sudo[797540]: pam_unix(sudo:session): session closed for user root
Sep 11 21:57:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 21:57:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:15 nativespace-cdp sudo[797579]: pam_unix(sudo:session): session closed for user root
Sep 11 21:57:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status nvihkvu
Sep 11 21:57:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:16 nativespace-cdp sudo[797583]: pam_unix(sudo:session): session closed for user root
Sep 11 21:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 21:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:19 nativespace-cdp sudo[797603]: pam_unix(sudo:session): session closed for user root
Sep 11 21:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status paulmca1
Sep 11 21:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:20 nativespace-cdp sudo[797607]: pam_unix(sudo:session): session closed for user root
Sep 11 21:57:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 21:57:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:21 nativespace-cdp sudo[797622]: pam_unix(sudo:session): session closed for user root
Sep 11 21:57:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status philmcph
Sep 11 21:57:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:22 nativespace-cdp sudo[797628]: pam_unix(sudo:session): session closed for user root
Sep 11 21:57:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 21:57:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:27 nativespace-cdp sudo[797662]: pam_unix(sudo:session): session closed for user root
Sep 11 21:57:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status ranxterc
Sep 11 21:57:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 21:57:28 nativespace-cdp sudo[797667]: pam_unix(sudo:session): session closed for user root
Sep 11 22:01:35 nativespace-cdp sshd[799048]: Connection closed by 159.100.136.21 port 51306 [preauth]
Sep 11 22:06:35 nativespace-cdp sshd[800071]: Connection closed by 159.100.136.21 port 60492 [preauth]
Sep 11 22:09:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 22:09:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:05 nativespace-cdp sudo[800488]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status tigerlet
Sep 11 22:09:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:06 nativespace-cdp sudo[800501]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:51 nativespace-cdp sudo[800680]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:51 nativespace-cdp sudo[800684]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:51 nativespace-cdp sudo[800689]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:51 nativespace-cdp sudo[800696]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:55 nativespace-cdp sudo[800702]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 22:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:55 nativespace-cdp sudo[800723]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 22:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:55 nativespace-cdp sudo[800728]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 22:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:55 nativespace-cdp sudo[800732]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 22:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:55 nativespace-cdp sudo[800737]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 22:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:55 nativespace-cdp sudo[800743]: pam_unix(sudo:session): session closed for user root
Sep 11 22:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 22:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:09:56 nativespace-cdp sudo[800748]: pam_unix(sudo:session): session closed for user root
Sep 11 22:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 22:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:10:24 nativespace-cdp sudo[801023]: pam_unix(sudo:session): session closed for user root
Sep 11 22:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 22:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:10:24 nativespace-cdp sudo[801031]: pam_unix(sudo:session): session closed for user root
Sep 11 22:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=brmrjxl user-2=lakesan1 user-3=strathar user-4=atestord user-5=sarafoundation user-6=wilsonsw user-7=megacards user-8=musorguk user-9=martsblo user-10=dickemery123 user-11=ptkxhsbt user-12=hhdugcor user-13=lbhyisi user-14=magichat user-15=booff user-16=foundation user-17=markward user-18=vantagep user-19=athenare user-20=connect9 user-21=lbscrmod user-22=maflemin user-23=ulsukarm user-24=jarvisin user-25=spectrum user-26=theblack user-27=hodgesonweb user-28=agproduc user-29=still user-30=stephani user-31=leereyn1 user-32=nstriton user-33=brighto1 user-34=vivienn1 user-35=firstre2 user-36=oneoarco user-37=battlere user-38=bedfords user-39=newstoda user-40=ggaaorgu user-41=belle user-42=bemadonn user-43=skyfirec user-44=alexadmin user-45=innovat1 user-46=askhform user-47=stuartge user-48=nativene
Sep 11 22:10:24 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ultbcrra user-50=seftvta user-51=jonhartl user-52=firstres user-53=coursemc user-54=opaiscyx user-55=firstrel user-56=clarkass user-57=costestimatorco user-58=firstred user-59=highlegh user-60=southlon user-61=gilpin user-62=milloyco user-63=elecleis user-64=hubmaster user-65=putterfi user-66=fetch user-67=carsinyo user-68=accooper user-69=ianrayne user-70=connectedshoppin user-71=thqkgnbz user-72=nscdp user-73=putterfc user-74=leftie user-75=foods user-76=health2045 user-77=fortunaz user-78=lkpier user-79=steakbridieme user-80=firstre5 user-81=donnychicago user-82=philmcph user-83=ctedorgu user-84=isleofwi user-85=smrszyqg user-86=nomistakes user-87=hidden user-88=barbersh user-89=tigerlet user-90=cambria1 user-91=cathski user-92=ninejimm user-93=reliable user-94=cwsocial user-95=pugwash user-96=howardon user-97=paulmca1 user-98=hirefootballgame user-99=eugincou user-100=courseme user-101=asandcoc
Sep 11 22:10:24 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sibtoncc user-103=bwppodcast user-104=zebrapho user-105=steve user-106=fawcettd user-107=burydropin user-108=nsceres user-109=beauty user-110=darkstar user-111=eatspam user-112=dhyana user-113=nove user-114=boldover user-115=bakery user-116=crrtipdl user-117=sosevalu user-118=oubpgvbx user-119=tstardom user-120=what user-121=havantho user-122=cath user-123=sketchy user-124=nvihkvu user-125=dancinggardener user-126=stagingerris user-127=ladburyp user-128=kategilpin user-129=design user-130=tomandle user-131=jennimil user-132=chrisdal user-133=mcdermos user-134=david user-135=nbhavers user-136=careers user-137=lucy user-138=attlebor user-139=onlycont user-140=hodgsonmail user-141=ranxterc user-142=outdoorc user-143=branko user-144=romaldki feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 22:10:24 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 22:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:10:26 nativespace-cdp sudo[801038]: pam_unix(sudo:session): session closed for user root
Sep 11 22:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 22:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:10:28 nativespace-cdp sudo[801055]: pam_unix(sudo:session): session closed for user root
Sep 11 22:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kYHrU5uixEpFyYFV.~
Sep 11 22:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:10:28 nativespace-cdp sudo[801060]: pam_unix(sudo:session): session closed for user root
Sep 11 22:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kYHrU5uixEpFyYFV.~'
Sep 11 22:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:10:28 nativespace-cdp sudo[801064]: pam_unix(sudo:session): session closed for user root
Sep 11 22:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kYHrU5uixEpFyYFV.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 22:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:10:28 nativespace-cdp sudo[801070]: pam_unix(sudo:session): session closed for user root
Sep 11 22:10:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 22:10:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:10:28 nativespace-cdp sudo[801075]: pam_unix(sudo:session): session closed for user root
Sep 11 22:10:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 22:10:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 22:10:56 nativespace-cdp sudo[801161]: pam_unix(sudo:session): session closed for user root
Sep 11 22:16:35 nativespace-cdp sshd[802918]: Connection closed by 159.100.136.21 port 50294 [preauth]
Sep 11 22:21:33 nativespace-cdp sshd[803987]: Connection closed by 159.100.136.21 port 59156 [preauth]
Sep 11 22:26:36 nativespace-cdp sshd[805494]: Connection closed by 159.100.136.21 port 40516 [preauth]
Sep 11 22:31:34 nativespace-cdp sshd[806643]: Connection closed by 159.100.136.21 port 49748 [preauth]
Sep 11 22:36:33 nativespace-cdp sshd[807682]: Connection closed by 159.100.136.21 port 58082 [preauth]
Sep 11 22:41:33 nativespace-cdp sshd[809143]: Connection closed by 159.100.136.21 port 39308 [preauth]
Sep 11 22:46:33 nativespace-cdp sshd[810292]: Connection closed by 159.100.136.21 port 46986 [preauth]
Sep 11 22:51:33 nativespace-cdp sshd[811438]: Connection closed by 159.100.136.21 port 56072 [preauth]
Sep 11 22:56:33 nativespace-cdp sshd[812544]: Connection closed by 159.100.136.21 port 37998 [preauth]
Sep 11 23:01:37 nativespace-cdp sshd[814031]: Connection closed by 159.100.136.21 port 47238 [preauth]
Sep 11 23:06:33 nativespace-cdp sshd[815056]: Connection closed by 159.100.136.21 port 56286 [preauth]
Sep 11 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 11 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:09:51 nativespace-cdp sudo[815909]: pam_unix(sudo:session): session closed for user root
Sep 11 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 11 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:09:51 nativespace-cdp sudo[815913]: pam_unix(sudo:session): session closed for user root
Sep 11 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 11 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:09:51 nativespace-cdp sudo[815918]: pam_unix(sudo:session): session closed for user root
Sep 11 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 11 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:09:51 nativespace-cdp sudo[815925]: pam_unix(sudo:session): session closed for user root
Sep 11 23:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 11 23:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:03 nativespace-cdp sudo[815931]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 11 23:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:04 nativespace-cdp sudo[816097]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 11 23:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:04 nativespace-cdp sudo[816100]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 11 23:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:04 nativespace-cdp sudo[816103]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 11 23:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:04 nativespace-cdp sudo[816106]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 11 23:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:04 nativespace-cdp sudo[816109]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 11 23:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:04 nativespace-cdp sudo[816112]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 11 23:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:06 nativespace-cdp sudo[816128]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 11 23:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:07 nativespace-cdp sudo[816133]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=connectedshoppin user-2=thqkgnbz user-3=accooper user-4=ianrayne user-5=hubmaster user-6=putterfi user-7=carsinyo user-8=fetch user-9=milloyco user-10=gilpin user-11=elecleis user-12=firstred user-13=southlon user-14=highlegh user-15=clarkass user-16=firstrel user-17=costestimatorco user-18=coursemc user-19=opaiscyx user-20=seftvta user-21=jonhartl user-22=ultbcrra user-23=firstres user-24=nativene user-25=innovat1 user-26=stuartge user-27=askhform user-28=alexadmin user-29=skyfirec user-30=ggaaorgu user-31=belle user-32=newstoda user-33=bemadonn user-34=bedfords user-35=firstre2 user-36=vivienn1 user-37=battlere user-38=oneoarco user-39=brighto1 user-40=nstriton user-41=stephani user-42=leereyn1 user-43=still user-44=agproduc user-45=spectrum user-46=theblack user-47=hodgesonweb
Sep 11 23:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=jarvisin user-49=ulsukarm user-50=athenare user-51=connect9 user-52=vantagep user-53=maflemin user-54=lbscrmod user-55=markward user-56=booff user-57=foundation user-58=magichat user-59=lbhyisi user-60=hhdugcor user-61=dickemery123 user-62=ptkxhsbt user-63=martsblo user-64=musorguk user-65=megacards user-66=wilsonsw user-67=strathar user-68=sarafoundation user-69=atestord user-70=brmrjxl user-71=lakesan1 user-72=romaldki user-73=ranxterc user-74=outdoorc user-75=hodgsonmail user-76=branko user-77=onlycont user-78=attlebor user-79=lucy user-80=careers user-81=nbhavers user-82=david user-83=chrisdal user-84=mcdermos user-85=jennimil user-86=tomandle user-87=design user-88=ladburyp user-89=stagingerris user-90=dancinggardener user-91=kategilpin user-92=sketchy user-93=cath user-94=havantho user-95=nvihkvu user-96=oubpgvbx user-97=tstardom user-98=what user-99=bakery user-100=sosevalu user-101=crrtipdl
Sep 11 23:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=boldover user-103=nove user-104=dhyana user-105=beauty user-106=eatspam user-107=darkstar user-108=nsceres user-109=burydropin user-110=fawcettd user-111=steve user-112=bwppodcast user-113=zebrapho user-114=sibtoncc user-115=asandcoc user-116=eugincou user-117=courseme user-118=hirefootballgame user-119=paulmca1 user-120=pugwash user-121=howardon user-122=cwsocial user-123=cambria1 user-124=cathski user-125=reliable user-126=ninejimm user-127=hidden user-128=nomistakes user-129=tigerlet user-130=barbersh user-131=smrszyqg user-132=isleofwi user-133=lkpier user-134=ctedorgu user-135=philmcph user-136=firstre5 user-137=steakbridieme user-138=donnychicago user-139=putterfc user-140=nscdp user-141=health2045 user-142=fortunaz user-143=foods user-144=leftie feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 11 23:10:07 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 11 23:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:08 nativespace-cdp sudo[816138]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 23:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:08 nativespace-cdp sudo[816146]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GbV8MC3H7vHycseC.~
Sep 11 23:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:08 nativespace-cdp sudo[816149]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GbV8MC3H7vHycseC.~'
Sep 11 23:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:08 nativespace-cdp sudo[816152]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-GbV8MC3H7vHycseC.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 11 23:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:08 nativespace-cdp sudo[816156]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 11 23:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:08 nativespace-cdp sudo[816159]: pam_unix(sudo:session): session closed for user root
Sep 11 23:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 11 23:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 11 23:10:10 nativespace-cdp sudo[816178]: pam_unix(sudo:session): session closed for user root
Sep 11 23:11:36 nativespace-cdp sshd[816870]: Connection closed by 159.100.136.21 port 37336 [preauth]
Sep 11 23:16:33 nativespace-cdp sshd[817881]: Connection closed by 159.100.136.21 port 45350 [preauth]
Sep 11 23:21:33 nativespace-cdp sshd[818911]: Connection closed by 159.100.136.21 port 54402 [preauth]
Sep 11 23:26:36 nativespace-cdp sshd[820216]: Connection closed by 159.100.136.21 port 35566 [preauth]
Sep 11 23:31:33 nativespace-cdp sshd[821503]: Connection closed by 159.100.136.21 port 45162 [preauth]
Sep 11 23:36:36 nativespace-cdp sshd[822494]: Connection closed by 159.100.136.21 port 54810 [preauth]
Sep 11 23:41:33 nativespace-cdp sshd[823898]: Connection closed by 159.100.136.21 port 36142 [preauth]
Sep 11 23:46:33 nativespace-cdp sshd[825060]: Connection closed by 159.100.136.21 port 45136 [preauth]
Sep 11 23:51:35 nativespace-cdp sshd[826138]: Connection closed by 159.100.136.21 port 54434 [preauth]
Sep 11 23:52:37 nativespace-cdp sshd[826378]: Invalid user arman from 157.245.100.228 port 45550
Sep 11 23:52:37 nativespace-cdp sshd[826378]: input_userauth_request: invalid user arman [preauth]
Sep 11 23:52:38 nativespace-cdp sshd[826378]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 23:52:38 nativespace-cdp sshd[826378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.100.228
Sep 11 23:52:40 nativespace-cdp sshd[826378]: Failed password for invalid user arman from 157.245.100.228 port 45550 ssh2
Sep 11 23:52:40 nativespace-cdp sshd[826378]: Received disconnect from 157.245.100.228 port 45550:11: Bye Bye [preauth]
Sep 11 23:52:40 nativespace-cdp sshd[826378]: Disconnected from 157.245.100.228 port 45550 [preauth]
Sep 11 23:52:47 nativespace-cdp sshd[826402]: Invalid user sakib from 128.65.125.6 port 56414
Sep 11 23:52:47 nativespace-cdp sshd[826402]: input_userauth_request: invalid user sakib [preauth]
Sep 11 23:52:47 nativespace-cdp sshd[826402]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 23:52:47 nativespace-cdp sshd[826402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.65.125.6
Sep 11 23:52:49 nativespace-cdp sshd[826402]: Failed password for invalid user sakib from 128.65.125.6 port 56414 ssh2
Sep 11 23:52:49 nativespace-cdp sshd[826402]: Received disconnect from 128.65.125.6 port 56414:11: Bye Bye [preauth]
Sep 11 23:52:49 nativespace-cdp sshd[826402]: Disconnected from 128.65.125.6 port 56414 [preauth]
Sep 11 23:55:45 nativespace-cdp sshd[827023]: Invalid user kocom from 128.199.117.9 port 43574
Sep 11 23:55:45 nativespace-cdp sshd[827023]: input_userauth_request: invalid user kocom [preauth]
Sep 11 23:55:45 nativespace-cdp sshd[827023]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 23:55:45 nativespace-cdp sshd[827023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.117.9
Sep 11 23:55:47 nativespace-cdp sshd[827023]: Failed password for invalid user kocom from 128.199.117.9 port 43574 ssh2
Sep 11 23:55:47 nativespace-cdp sshd[827023]: Received disconnect from 128.199.117.9 port 43574:11: Bye Bye [preauth]
Sep 11 23:55:47 nativespace-cdp sshd[827023]: Disconnected from 128.199.117.9 port 43574 [preauth]
Sep 11 23:56:16 nativespace-cdp sshd[827101]: Connection closed by 157.245.100.228 port 54434 [preauth]
Sep 11 23:56:24 nativespace-cdp sshd[827203]: Invalid user umut from 128.65.125.6 port 59582
Sep 11 23:56:24 nativespace-cdp sshd[827203]: input_userauth_request: invalid user umut [preauth]
Sep 11 23:56:24 nativespace-cdp sshd[827203]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 23:56:24 nativespace-cdp sshd[827203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.65.125.6
Sep 11 23:56:26 nativespace-cdp sshd[827203]: Failed password for invalid user umut from 128.65.125.6 port 59582 ssh2
Sep 11 23:56:26 nativespace-cdp sshd[827203]: Received disconnect from 128.65.125.6 port 59582:11: Bye Bye [preauth]
Sep 11 23:56:26 nativespace-cdp sshd[827203]: Disconnected from 128.65.125.6 port 59582 [preauth]
Sep 11 23:56:35 nativespace-cdp sshd[827226]: Connection closed by 159.100.136.21 port 35494 [preauth]
Sep 11 23:56:56 nativespace-cdp sshd[827309]: Invalid user aaa from 157.245.100.228 port 48026
Sep 11 23:56:56 nativespace-cdp sshd[827309]: input_userauth_request: invalid user aaa [preauth]
Sep 11 23:56:56 nativespace-cdp sshd[827309]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 23:56:56 nativespace-cdp sshd[827309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.100.228
Sep 11 23:56:58 nativespace-cdp sshd[827376]: Invalid user arman from 128.199.117.9 port 45176
Sep 11 23:56:58 nativespace-cdp sshd[827376]: input_userauth_request: invalid user arman [preauth]
Sep 11 23:56:58 nativespace-cdp sshd[827376]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 23:56:58 nativespace-cdp sshd[827376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.117.9
Sep 11 23:56:58 nativespace-cdp sshd[827309]: Failed password for invalid user aaa from 157.245.100.228 port 48026 ssh2
Sep 11 23:56:58 nativespace-cdp sshd[827309]: Received disconnect from 157.245.100.228 port 48026:11: Bye Bye [preauth]
Sep 11 23:56:58 nativespace-cdp sshd[827309]: Disconnected from 157.245.100.228 port 48026 [preauth]
Sep 11 23:57:00 nativespace-cdp sshd[827376]: Failed password for invalid user arman from 128.199.117.9 port 45176 ssh2
Sep 11 23:57:03 nativespace-cdp sshd[827434]: Invalid user dokku from 128.65.125.6 port 44482
Sep 11 23:57:03 nativespace-cdp sshd[827434]: input_userauth_request: invalid user dokku [preauth]
Sep 11 23:57:03 nativespace-cdp sshd[827434]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 23:57:03 nativespace-cdp sshd[827434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.65.125.6
Sep 11 23:57:04 nativespace-cdp sshd[827376]: Received disconnect from 128.199.117.9 port 45176:11: Bye Bye [preauth]
Sep 11 23:57:04 nativespace-cdp sshd[827376]: Disconnected from 128.199.117.9 port 45176 [preauth]
Sep 11 23:57:05 nativespace-cdp sshd[827434]: Failed password for invalid user dokku from 128.65.125.6 port 44482 ssh2
Sep 11 23:57:05 nativespace-cdp sshd[827434]: Received disconnect from 128.65.125.6 port 44482:11: Bye Bye [preauth]
Sep 11 23:57:05 nativespace-cdp sshd[827434]: Disconnected from 128.65.125.6 port 44482 [preauth]
Sep 11 23:57:44 nativespace-cdp sshd[827652]: Invalid user light from 157.245.100.228 port 55982
Sep 11 23:57:44 nativespace-cdp sshd[827652]: input_userauth_request: invalid user light [preauth]
Sep 11 23:57:44 nativespace-cdp sshd[827652]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 23:57:44 nativespace-cdp sshd[827652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.100.228
Sep 11 23:57:45 nativespace-cdp sshd[827652]: Failed password for invalid user light from 157.245.100.228 port 55982 ssh2
Sep 11 23:57:45 nativespace-cdp sshd[827652]: Received disconnect from 157.245.100.228 port 55982:11: Bye Bye [preauth]
Sep 11 23:57:45 nativespace-cdp sshd[827652]: Disconnected from 157.245.100.228 port 55982 [preauth]
Sep 11 23:57:46 nativespace-cdp sshd[827663]: Invalid user bogdan from 128.199.117.9 port 57790
Sep 11 23:57:46 nativespace-cdp sshd[827663]: input_userauth_request: invalid user bogdan [preauth]
Sep 11 23:57:46 nativespace-cdp sshd[827663]: pam_unix(sshd:auth): check pass; user unknown
Sep 11 23:57:46 nativespace-cdp sshd[827663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.117.9
Sep 11 23:57:48 nativespace-cdp sshd[827663]: Failed password for invalid user bogdan from 128.199.117.9 port 57790 ssh2
Sep 11 23:57:50 nativespace-cdp sshd[827663]: Received disconnect from 128.199.117.9 port 57790:11: Bye Bye [preauth]
Sep 11 23:57:50 nativespace-cdp sshd[827663]: Disconnected from 128.199.117.9 port 57790 [preauth]
Sep 12 00:01:33 nativespace-cdp sshd[828612]: Connection closed by 159.100.136.21 port 44254 [preauth]
Sep 12 00:06:33 nativespace-cdp sshd[829914]: Connection closed by 159.100.136.21 port 53014 [preauth]
Sep 12 00:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 00:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:51 nativespace-cdp sudo[830611]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:51 nativespace-cdp sudo[830616]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:51 nativespace-cdp sudo[830621]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:51 nativespace-cdp sudo[830628]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 00:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:54 nativespace-cdp sudo[830634]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 00:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:54 nativespace-cdp sudo[830646]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 00:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:54 nativespace-cdp sudo[830651]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 00:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:54 nativespace-cdp sudo[830655]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 00:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:54 nativespace-cdp sudo[830660]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 00:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:54 nativespace-cdp sudo[830666]: pam_unix(sudo:session): session closed for user root
Sep 12 00:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 00:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:09:54 nativespace-cdp sudo[830672]: pam_unix(sudo:session): session closed for user root
Sep 12 00:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 00:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:10:01 nativespace-cdp sudo[830697]: pam_unix(sudo:session): session closed for user root
Sep 12 00:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 00:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:10:01 nativespace-cdp sudo[830774]: pam_unix(sudo:session): session closed for user root
Sep 12 00:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=strathar user-2=sarafoundation user-3=atestord user-4=brmrjxl user-5=lakesan1 user-6=musorguk user-7=megacards user-8=wilsonsw user-9=dickemery123 user-10=ptkxhsbt user-11=martsblo user-12=magichat user-13=lbhyisi user-14=hhdugcor user-15=athenare user-16=connect9 user-17=vantagep user-18=maflemin user-19=lbscrmod user-20=markward user-21=booff user-22=foundation user-23=ulsukarm user-24=spectrum user-25=hodgesonweb user-26=theblack user-27=jarvisin user-28=stephani user-29=leereyn1 user-30=still user-31=agproduc user-32=firstre2 user-33=vivienn1 user-34=battlere user-35=oneoarco user-36=brighto1 user-37=nstriton user-38=belle user-39=ggaaorgu user-40=newstoda user-41=bemadonn user-42=bedfords user-43=alexadmin user-44=skyfirec user-45=nativene user-46=innovat1 user-47=stuartge user-48=askhform
Sep 12 00:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=opaiscyx user-50=coursemc user-51=seftvta user-52=jonhartl user-53=ultbcrra user-54=firstres user-55=firstred user-56=southlon user-57=highlegh user-58=clarkass user-59=firstrel user-60=costestimatorco user-61=hubmaster user-62=putterfi user-63=carsinyo user-64=fetch user-65=gilpin user-66=milloyco user-67=elecleis user-68=connectedshoppin user-69=thqkgnbz user-70=accooper user-71=ianrayne user-72=lkpier user-73=philmcph user-74=ctedorgu user-75=donnychicago user-76=steakbridieme user-77=firstre5 user-78=putterfc user-79=nscdp user-80=health2045 user-81=fortunaz user-82=leftie user-83=foods user-84=hidden user-85=nomistakes user-86=barbersh user-87=tigerlet user-88=smrszyqg user-89=isleofwi user-90=howardon user-91=pugwash user-92=paulmca1 user-93=cwsocial user-94=cathski user-95=cambria1 user-96=ninejimm user-97=reliable user-98=eugincou user-99=courseme user-100=hirefootballgame user-101=sibtoncc
Sep 12 00:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=asandcoc user-103=steve user-104=bwppodcast user-105=zebrapho user-106=nsceres user-107=burydropin user-108=fawcettd user-109=dhyana user-110=beauty user-111=eatspam user-112=darkstar user-113=boldover user-114=nove user-115=bakery user-116=sosevalu user-117=crrtipdl user-118=cath user-119=sketchy user-120=havantho user-121=nvihkvu user-122=oubpgvbx user-123=tstardom user-124=what user-125=design user-126=ladburyp user-127=dancinggardener user-128=stagingerris user-129=kategilpin user-130=jennimil user-131=tomandle user-132=nbhavers user-133=careers user-134=david user-135=chrisdal user-136=mcdermos user-137=onlycont user-138=attlebor user-139=lucy user-140=romaldki user-141=hodgsonmail user-142=outdoorc user-143=ranxterc user-144=branko feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 00:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 00:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:10:02 nativespace-cdp sudo[830796]: pam_unix(sudo:session): session closed for user root
Sep 12 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:10:03 nativespace-cdp sudo[830876]: pam_unix(sudo:session): session closed for user root
Sep 12 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YbZBCbf6nCW5mY8I.~
Sep 12 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:10:03 nativespace-cdp sudo[830881]: pam_unix(sudo:session): session closed for user root
Sep 12 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YbZBCbf6nCW5mY8I.~'
Sep 12 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:10:03 nativespace-cdp sudo[830885]: pam_unix(sudo:session): session closed for user root
Sep 12 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YbZBCbf6nCW5mY8I.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:10:03 nativespace-cdp sudo[830889]: pam_unix(sudo:session): session closed for user root
Sep 12 00:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 00:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:10:03 nativespace-cdp sudo[830892]: pam_unix(sudo:session): session closed for user root
Sep 12 00:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 00:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 00:10:10 nativespace-cdp sudo[830956]: pam_unix(sudo:session): session closed for user root
Sep 12 00:11:34 nativespace-cdp sshd[831626]: Connection closed by 159.100.136.21 port 33644 [preauth]
Sep 12 00:16:36 nativespace-cdp sshd[832896]: Connection closed by 159.100.136.21 port 42346 [preauth]
Sep 12 00:21:36 nativespace-cdp sshd[834106]: Connection closed by 159.100.136.21 port 51494 [preauth]
Sep 12 00:26:33 nativespace-cdp sshd[835684]: Connection closed by 159.100.136.21 port 32828 [preauth]
Sep 12 00:31:33 nativespace-cdp sshd[836754]: Connection closed by 159.100.136.21 port 41626 [preauth]
Sep 12 00:35:00 nativespace-cdp sshd[837336]: Did not receive identification string from 87.236.176.39 port 50871
Sep 12 00:35:01 nativespace-cdp sshd[837345]: Connection closed by 87.236.176.39 port 51659 [preauth]
Sep 12 00:36:34 nativespace-cdp sshd[837740]: Connection closed by 159.100.136.21 port 50062 [preauth]
Sep 12 00:40:42 nativespace-cdp sshd[838652]: Invalid user business from 174.138.92.74 port 51178
Sep 12 00:40:42 nativespace-cdp sshd[838652]: input_userauth_request: invalid user business [preauth]
Sep 12 00:40:42 nativespace-cdp sshd[838652]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:40:42 nativespace-cdp sshd[838652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.92.74
Sep 12 00:40:44 nativespace-cdp sshd[838652]: Failed password for invalid user business from 174.138.92.74 port 51178 ssh2
Sep 12 00:40:45 nativespace-cdp sshd[838652]: Received disconnect from 174.138.92.74 port 51178:11: Bye Bye [preauth]
Sep 12 00:40:45 nativespace-cdp sshd[838652]: Disconnected from 174.138.92.74 port 51178 [preauth]
Sep 12 00:41:02 nativespace-cdp sshd[838685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.150.73  user=root
Sep 12 00:41:02 nativespace-cdp sshd[838685]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 00:41:03 nativespace-cdp sshd[838685]: Failed password for root from 47.236.150.73 port 37784 ssh2
Sep 12 00:41:07 nativespace-cdp sshd[838725]: Invalid user testadmin from 89.144.195.204 port 57285
Sep 12 00:41:07 nativespace-cdp sshd[838725]: input_userauth_request: invalid user testadmin [preauth]
Sep 12 00:41:07 nativespace-cdp sshd[838725]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:41:07 nativespace-cdp sshd[838725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.144.195.204
Sep 12 00:41:08 nativespace-cdp sshd[838685]: Received disconnect from 47.236.150.73 port 37784:11: Bye Bye [preauth]
Sep 12 00:41:08 nativespace-cdp sshd[838685]: Disconnected from 47.236.150.73 port 37784 [preauth]
Sep 12 00:41:09 nativespace-cdp sshd[838725]: Failed password for invalid user testadmin from 89.144.195.204 port 57285 ssh2
Sep 12 00:41:09 nativespace-cdp sshd[838725]: Received disconnect from 89.144.195.204 port 57285:11: Bye Bye [preauth]
Sep 12 00:41:09 nativespace-cdp sshd[838725]: Disconnected from 89.144.195.204 port 57285 [preauth]
Sep 12 00:41:36 nativespace-cdp sshd[838801]: Connection closed by 159.100.136.21 port 59540 [preauth]
Sep 12 00:42:42 nativespace-cdp sshd[839073]: Invalid user prueba2 from 164.92.112.124 port 53290
Sep 12 00:42:42 nativespace-cdp sshd[839073]: input_userauth_request: invalid user prueba2 [preauth]
Sep 12 00:42:42 nativespace-cdp sshd[839073]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:42:42 nativespace-cdp sshd[839073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.112.124
Sep 12 00:42:44 nativespace-cdp sshd[839073]: Failed password for invalid user prueba2 from 164.92.112.124 port 53290 ssh2
Sep 12 00:42:47 nativespace-cdp sshd[839073]: Received disconnect from 164.92.112.124 port 53290:11: Bye Bye [preauth]
Sep 12 00:42:47 nativespace-cdp sshd[839073]: Disconnected from 164.92.112.124 port 53290 [preauth]
Sep 12 00:42:52 nativespace-cdp sshd[839092]: Invalid user ganesh from 34.101.245.3 port 3103
Sep 12 00:42:52 nativespace-cdp sshd[839092]: input_userauth_request: invalid user ganesh [preauth]
Sep 12 00:42:52 nativespace-cdp sshd[839092]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:42:52 nativespace-cdp sshd[839092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.101.245.3
Sep 12 00:42:54 nativespace-cdp sshd[839092]: Failed password for invalid user ganesh from 34.101.245.3 port 3103 ssh2
Sep 12 00:42:54 nativespace-cdp sshd[839092]: Received disconnect from 34.101.245.3 port 3103:11: Bye Bye [preauth]
Sep 12 00:42:54 nativespace-cdp sshd[839092]: Disconnected from 34.101.245.3 port 3103 [preauth]
Sep 12 00:43:00 nativespace-cdp sshd[839110]: Invalid user wireguard from 47.236.150.73 port 60642
Sep 12 00:43:00 nativespace-cdp sshd[839110]: input_userauth_request: invalid user wireguard [preauth]
Sep 12 00:43:00 nativespace-cdp sshd[839110]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:43:00 nativespace-cdp sshd[839110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.150.73
Sep 12 00:43:02 nativespace-cdp sshd[839110]: Failed password for invalid user wireguard from 47.236.150.73 port 60642 ssh2
Sep 12 00:43:04 nativespace-cdp sshd[839110]: Received disconnect from 47.236.150.73 port 60642:11: Bye Bye [preauth]
Sep 12 00:43:04 nativespace-cdp sshd[839110]: Disconnected from 47.236.150.73 port 60642 [preauth]
Sep 12 00:43:24 nativespace-cdp sshd[839216]: Invalid user testadmin from 47.236.150.73 port 45046
Sep 12 00:43:24 nativespace-cdp sshd[839216]: input_userauth_request: invalid user testadmin [preauth]
Sep 12 00:43:24 nativespace-cdp sshd[839216]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:43:24 nativespace-cdp sshd[839216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.150.73
Sep 12 00:43:26 nativespace-cdp sshd[839216]: Failed password for invalid user testadmin from 47.236.150.73 port 45046 ssh2
Sep 12 00:43:26 nativespace-cdp sshd[839216]: Received disconnect from 47.236.150.73 port 45046:11: Bye Bye [preauth]
Sep 12 00:43:26 nativespace-cdp sshd[839216]: Disconnected from 47.236.150.73 port 45046 [preauth]
Sep 12 00:44:08 nativespace-cdp sshd[839772]: Invalid user minecraft from 164.92.112.124 port 41852
Sep 12 00:44:08 nativespace-cdp sshd[839772]: input_userauth_request: invalid user minecraft [preauth]
Sep 12 00:44:08 nativespace-cdp sshd[839772]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:44:08 nativespace-cdp sshd[839772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.112.124
Sep 12 00:44:10 nativespace-cdp sshd[839772]: Failed password for invalid user minecraft from 164.92.112.124 port 41852 ssh2
Sep 12 00:44:12 nativespace-cdp sshd[839772]: Received disconnect from 164.92.112.124 port 41852:11: Bye Bye [preauth]
Sep 12 00:44:12 nativespace-cdp sshd[839772]: Disconnected from 164.92.112.124 port 41852 [preauth]
Sep 12 00:44:20 nativespace-cdp sshd[839807]: Invalid user special from 89.144.195.204 port 57286
Sep 12 00:44:20 nativespace-cdp sshd[839807]: input_userauth_request: invalid user special [preauth]
Sep 12 00:44:20 nativespace-cdp sshd[839807]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:44:20 nativespace-cdp sshd[839807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.144.195.204
Sep 12 00:44:21 nativespace-cdp sshd[839807]: Failed password for invalid user special from 89.144.195.204 port 57286 ssh2
Sep 12 00:44:22 nativespace-cdp sshd[839807]: Received disconnect from 89.144.195.204 port 57286:11: Bye Bye [preauth]
Sep 12 00:44:22 nativespace-cdp sshd[839807]: Disconnected from 89.144.195.204 port 57286 [preauth]
Sep 12 00:44:23 nativespace-cdp sshd[839816]: Invalid user ganesh from 174.138.92.74 port 48972
Sep 12 00:44:23 nativespace-cdp sshd[839816]: input_userauth_request: invalid user ganesh [preauth]
Sep 12 00:44:23 nativespace-cdp sshd[839816]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:44:23 nativespace-cdp sshd[839816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.92.74
Sep 12 00:44:25 nativespace-cdp sshd[839816]: Failed password for invalid user ganesh from 174.138.92.74 port 48972 ssh2
Sep 12 00:44:27 nativespace-cdp sshd[839816]: Received disconnect from 174.138.92.74 port 48972:11: Bye Bye [preauth]
Sep 12 00:44:27 nativespace-cdp sshd[839816]: Disconnected from 174.138.92.74 port 48972 [preauth]
Sep 12 00:44:33 nativespace-cdp sshd[839839]: Invalid user tms from 34.101.245.3 port 3102
Sep 12 00:44:33 nativespace-cdp sshd[839839]: input_userauth_request: invalid user tms [preauth]
Sep 12 00:44:33 nativespace-cdp sshd[839839]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:44:33 nativespace-cdp sshd[839839]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.101.245.3
Sep 12 00:44:36 nativespace-cdp sshd[839839]: Failed password for invalid user tms from 34.101.245.3 port 3102 ssh2
Sep 12 00:44:43 nativespace-cdp sshd[839839]: Received disconnect from 34.101.245.3 port 3102:11: Bye Bye [preauth]
Sep 12 00:44:43 nativespace-cdp sshd[839839]: Disconnected from 34.101.245.3 port 3102 [preauth]
Sep 12 00:44:53 nativespace-cdp sshd[839898]: Invalid user ganesh from 164.92.112.124 port 54638
Sep 12 00:44:53 nativespace-cdp sshd[839898]: input_userauth_request: invalid user ganesh [preauth]
Sep 12 00:44:53 nativespace-cdp sshd[839898]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:44:53 nativespace-cdp sshd[839898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.112.124
Sep 12 00:44:55 nativespace-cdp sshd[839898]: Failed password for invalid user ganesh from 164.92.112.124 port 54638 ssh2
Sep 12 00:44:58 nativespace-cdp sshd[839898]: Received disconnect from 164.92.112.124 port 54638:11: Bye Bye [preauth]
Sep 12 00:44:58 nativespace-cdp sshd[839898]: Disconnected from 164.92.112.124 port 54638 [preauth]
Sep 12 00:45:04 nativespace-cdp sshd[840086]: Invalid user zhanna from 174.138.92.74 port 58556
Sep 12 00:45:04 nativespace-cdp sshd[840086]: input_userauth_request: invalid user zhanna [preauth]
Sep 12 00:45:04 nativespace-cdp sshd[840086]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:45:04 nativespace-cdp sshd[840086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.92.74
Sep 12 00:45:06 nativespace-cdp sshd[840086]: Failed password for invalid user zhanna from 174.138.92.74 port 58556 ssh2
Sep 12 00:45:09 nativespace-cdp sshd[840086]: Received disconnect from 174.138.92.74 port 58556:11: Bye Bye [preauth]
Sep 12 00:45:09 nativespace-cdp sshd[840086]: Disconnected from 174.138.92.74 port 58556 [preauth]
Sep 12 00:45:10 nativespace-cdp sshd[840121]: Invalid user user from 89.144.195.204 port 57287
Sep 12 00:45:10 nativespace-cdp sshd[840121]: input_userauth_request: invalid user user [preauth]
Sep 12 00:45:10 nativespace-cdp sshd[840121]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:45:10 nativespace-cdp sshd[840121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.144.195.204
Sep 12 00:45:11 nativespace-cdp sshd[840121]: Failed password for invalid user user from 89.144.195.204 port 57287 ssh2
Sep 12 00:45:11 nativespace-cdp sshd[840121]: Received disconnect from 89.144.195.204 port 57287:11: Bye Bye [preauth]
Sep 12 00:45:11 nativespace-cdp sshd[840121]: Disconnected from 89.144.195.204 port 57287 [preauth]
Sep 12 00:45:25 nativespace-cdp sshd[840206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.101.245.3  user=root
Sep 12 00:45:25 nativespace-cdp sshd[840206]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 00:45:27 nativespace-cdp sshd[840206]: Failed password for root from 34.101.245.3 port 3091 ssh2
Sep 12 00:46:33 nativespace-cdp sshd[840454]: Connection closed by 159.100.136.21 port 40946 [preauth]
Sep 12 00:51:33 nativespace-cdp sshd[841519]: Connection closed by 159.100.136.21 port 50160 [preauth]
Sep 12 00:54:25 nativespace-cdp sshd[842065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.99.20  user=root
Sep 12 00:54:25 nativespace-cdp sshd[842065]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 00:54:26 nativespace-cdp sshd[842065]: Failed password for root from 188.166.99.20 port 41148 ssh2
Sep 12 00:54:26 nativespace-cdp sshd[842065]: Received disconnect from 188.166.99.20 port 41148:11: Bye Bye [preauth]
Sep 12 00:54:26 nativespace-cdp sshd[842065]: Disconnected from 188.166.99.20 port 41148 [preauth]
Sep 12 00:54:57 nativespace-cdp sshd[842119]: Invalid user mph from 150.95.27.208 port 38378
Sep 12 00:54:57 nativespace-cdp sshd[842119]: input_userauth_request: invalid user mph [preauth]
Sep 12 00:54:57 nativespace-cdp sshd[842119]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:54:57 nativespace-cdp sshd[842119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.27.208
Sep 12 00:54:59 nativespace-cdp sshd[842119]: Failed password for invalid user mph from 150.95.27.208 port 38378 ssh2
Sep 12 00:54:59 nativespace-cdp sshd[842119]: Received disconnect from 150.95.27.208 port 38378:11: Bye Bye [preauth]
Sep 12 00:54:59 nativespace-cdp sshd[842119]: Disconnected from 150.95.27.208 port 38378 [preauth]
Sep 12 00:56:36 nativespace-cdp sshd[842648]: Connection closed by 159.100.136.21 port 59828 [preauth]
Sep 12 00:57:37 nativespace-cdp sshd[843236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.99.20  user=root
Sep 12 00:57:37 nativespace-cdp sshd[843236]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 00:57:39 nativespace-cdp sshd[843236]: Failed password for root from 188.166.99.20 port 52062 ssh2
Sep 12 00:57:43 nativespace-cdp sshd[843236]: Received disconnect from 188.166.99.20 port 52062:11: Bye Bye [preauth]
Sep 12 00:57:43 nativespace-cdp sshd[843236]: Disconnected from 188.166.99.20 port 52062 [preauth]
Sep 12 00:58:17 nativespace-cdp sshd[843333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.99.20  user=root
Sep 12 00:58:17 nativespace-cdp sshd[843333]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 00:58:19 nativespace-cdp sshd[843336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.27.208  user=root
Sep 12 00:58:19 nativespace-cdp sshd[843336]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 00:58:19 nativespace-cdp sshd[843333]: Failed password for root from 188.166.99.20 port 60060 ssh2
Sep 12 00:58:21 nativespace-cdp sshd[843336]: Failed password for root from 150.95.27.208 port 40826 ssh2
Sep 12 00:58:21 nativespace-cdp sshd[843336]: Received disconnect from 150.95.27.208 port 40826:11: Bye Bye [preauth]
Sep 12 00:58:21 nativespace-cdp sshd[843336]: Disconnected from 150.95.27.208 port 40826 [preauth]
Sep 12 00:59:19 nativespace-cdp sshd[843513]: Invalid user smart from 150.95.27.208 port 55990
Sep 12 00:59:19 nativespace-cdp sshd[843513]: input_userauth_request: invalid user smart [preauth]
Sep 12 00:59:19 nativespace-cdp sshd[843513]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 00:59:19 nativespace-cdp sshd[843513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.27.208
Sep 12 00:59:21 nativespace-cdp sshd[843513]: Failed password for invalid user smart from 150.95.27.208 port 55990 ssh2
Sep 12 00:59:23 nativespace-cdp sshd[843513]: Received disconnect from 150.95.27.208 port 55990:11: Bye Bye [preauth]
Sep 12 00:59:23 nativespace-cdp sshd[843513]: Disconnected from 150.95.27.208 port 55990 [preauth]
Sep 12 01:01:33 nativespace-cdp sshd[844151]: Connection closed by 159.100.136.21 port 40586 [preauth]
Sep 12 01:06:33 nativespace-cdp sshd[845161]: Connection closed by 159.100.136.21 port 46984 [preauth]
Sep 12 01:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 01:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:54 nativespace-cdp sudo[845792]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 01:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:54 nativespace-cdp sudo[845795]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 01:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:56 nativespace-cdp sudo[845798]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 01:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:56 nativespace-cdp sudo[845804]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 01:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:58 nativespace-cdp sudo[845807]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 01:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:58 nativespace-cdp sudo[845818]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 01:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:58 nativespace-cdp sudo[845821]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 01:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:58 nativespace-cdp sudo[845824]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 01:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:58 nativespace-cdp sudo[845827]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 01:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:58 nativespace-cdp sudo[845830]: pam_unix(sudo:session): session closed for user root
Sep 12 01:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 01:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:09:58 nativespace-cdp sudo[845833]: pam_unix(sudo:session): session closed for user root
Sep 12 01:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 01:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:10:09 nativespace-cdp sudo[846004]: pam_unix(sudo:session): session closed for user root
Sep 12 01:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 01:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:10:10 nativespace-cdp sudo[846008]: pam_unix(sudo:session): session closed for user root
Sep 12 01:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=carsinyo user-2=fetch user-3=hubmaster user-4=putterfi user-5=elecleis user-6=gilpin user-7=milloyco user-8=thqkgnbz user-9=connectedshoppin user-10=ianrayne user-11=accooper user-12=opaiscyx user-13=coursemc user-14=firstres user-15=jonhartl user-16=seftvta user-17=ultbcrra user-18=southlon user-19=highlegh user-20=firstred user-21=costestimatorco user-22=clarkass user-23=firstrel user-24=skyfirec user-25=alexadmin user-26=nativene user-27=stuartge user-28=askhform user-29=innovat1 user-30=battlere user-31=oneoarco user-32=firstre2 user-33=vivienn1 user-34=brighto1 user-35=nstriton user-36=bemadonn user-37=ggaaorgu user-38=belle user-39=newstoda user-40=bedfords user-41=theblack user-42=hodgesonweb user-43=spectrum user-44=jarvisin user-45=leereyn1 user-46=stephani user-47=still
Sep 12 01:10:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=agproduc user-49=maflemin user-50=lbscrmod user-51=athenare user-52=connect9 user-53=vantagep user-54=booff user-55=foundation user-56=markward user-57=ulsukarm user-58=ptkxhsbt user-59=dickemery123 user-60=martsblo user-61=magichat user-62=lbhyisi user-63=hhdugcor user-64=sarafoundation user-65=atestord user-66=strathar user-67=lakesan1 user-68=brmrjxl user-69=musorguk user-70=megacards user-71=wilsonsw user-72=onlycont user-73=attlebor user-74=lucy user-75=romaldki user-76=branko user-77=outdoorc user-78=hodgsonmail user-79=ranxterc user-80=jennimil user-81=tomandle user-82=careers user-83=nbhavers user-84=david user-85=mcdermos user-86=chrisdal user-87=nvihkvu user-88=sketchy user-89=cath user-90=havantho user-91=what user-92=tstardom user-93=oubpgvbx user-94=design user-95=kategilpin user-96=ladburyp user-97=dancinggardener user-98=stagingerris user-99=boldover user-100=nove user-101=sosevalu
Sep 12 01:10:10 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=crrtipdl user-103=bakery user-104=nsceres user-105=burydropin user-106=fawcettd user-107=dhyana user-108=eatspam user-109=darkstar user-110=beauty user-111=asandcoc user-112=sibtoncc user-113=steve user-114=zebrapho user-115=bwppodcast user-116=howardon user-117=paulmca1 user-118=pugwash user-119=cwsocial user-120=ninejimm user-121=reliable user-122=cathski user-123=cambria1 user-124=courseme user-125=eugincou user-126=hirefootballgame user-127=philmcph user-128=ctedorgu user-129=steakbridieme user-130=firstre5 user-131=donnychicago user-132=lkpier user-133=health2045 user-134=fortunaz user-135=leftie user-136=foods user-137=putterfc user-138=nscdp user-139=barbersh user-140=tigerlet user-141=hidden user-142=nomistakes user-143=isleofwi user-144=smrszyqg feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 12 01:10:10 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 01:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:10:10 nativespace-cdp sudo[846013]: pam_unix(sudo:session): session closed for user root
Sep 12 01:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 01:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:10:11 nativespace-cdp sudo[846020]: pam_unix(sudo:session): session closed for user root
Sep 12 01:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ScxHDDkYIA1Z45Y9.~
Sep 12 01:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:10:11 nativespace-cdp sudo[846024]: pam_unix(sudo:session): session closed for user root
Sep 12 01:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ScxHDDkYIA1Z45Y9.~'
Sep 12 01:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:10:11 nativespace-cdp sudo[846027]: pam_unix(sudo:session): session closed for user root
Sep 12 01:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ScxHDDkYIA1Z45Y9.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 01:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:10:11 nativespace-cdp sudo[846031]: pam_unix(sudo:session): session closed for user root
Sep 12 01:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 01:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:10:11 nativespace-cdp sudo[846034]: pam_unix(sudo:session): session closed for user root
Sep 12 01:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 01:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 01:10:19 nativespace-cdp sudo[846073]: pam_unix(sudo:session): session closed for user root
Sep 12 01:11:33 nativespace-cdp sshd[846428]: Connection closed by 159.100.136.21 port 54604 [preauth]
Sep 12 01:16:33 nativespace-cdp sshd[847614]: Connection closed by 159.100.136.21 port 36130 [preauth]
Sep 12 01:21:36 nativespace-cdp sshd[848967]: Connection closed by 159.100.136.21 port 45164 [preauth]
Sep 12 01:26:34 nativespace-cdp sshd[850048]: Connection closed by 159.100.136.21 port 54376 [preauth]
Sep 12 01:31:33 nativespace-cdp sshd[851455]: Connection closed by 159.100.136.21 port 35756 [preauth]
Sep 12 01:36:34 nativespace-cdp sshd[852495]: Connection closed by 159.100.136.21 port 44192 [preauth]
Sep 12 01:40:45 nativespace-cdp sshd[853410]: Invalid user fin from 160.22.174.194 port 60272
Sep 12 01:40:45 nativespace-cdp sshd[853410]: input_userauth_request: invalid user fin [preauth]
Sep 12 01:40:45 nativespace-cdp sshd[853410]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 01:40:45 nativespace-cdp sshd[853410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.22.174.194
Sep 12 01:40:47 nativespace-cdp sshd[853410]: Failed password for invalid user fin from 160.22.174.194 port 60272 ssh2
Sep 12 01:40:50 nativespace-cdp sshd[853410]: Received disconnect from 160.22.174.194 port 60272:11: Bye Bye [preauth]
Sep 12 01:40:50 nativespace-cdp sshd[853410]: Disconnected from 160.22.174.194 port 60272 [preauth]
Sep 12 01:41:33 nativespace-cdp sshd[853673]: Connection closed by 159.100.136.21 port 52918 [preauth]
Sep 12 01:46:33 nativespace-cdp sshd[855093]: Connection closed by 159.100.136.21 port 34460 [preauth]
Sep 12 01:47:44 nativespace-cdp sshd[855270]: Invalid user kramar from 160.22.174.194 port 42748
Sep 12 01:47:44 nativespace-cdp sshd[855270]: input_userauth_request: invalid user kramar [preauth]
Sep 12 01:47:44 nativespace-cdp sshd[855270]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 01:47:44 nativespace-cdp sshd[855270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.22.174.194
Sep 12 01:47:45 nativespace-cdp sshd[855270]: Failed password for invalid user kramar from 160.22.174.194 port 42748 ssh2
Sep 12 01:47:46 nativespace-cdp sshd[855270]: Received disconnect from 160.22.174.194 port 42748:11: Bye Bye [preauth]
Sep 12 01:47:46 nativespace-cdp sshd[855270]: Disconnected from 160.22.174.194 port 42748 [preauth]
Sep 12 01:48:42 nativespace-cdp sshd[855503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.22.174.194  user=root
Sep 12 01:48:42 nativespace-cdp sshd[855503]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 01:48:44 nativespace-cdp sshd[855503]: Failed password for root from 160.22.174.194 port 34700 ssh2
Sep 12 01:48:44 nativespace-cdp sshd[855503]: Received disconnect from 160.22.174.194 port 34700:11: Bye Bye [preauth]
Sep 12 01:48:44 nativespace-cdp sshd[855503]: Disconnected from 160.22.174.194 port 34700 [preauth]
Sep 12 01:51:33 nativespace-cdp sshd[856238]: Connection closed by 159.100.136.21 port 42444 [preauth]
Sep 12 01:56:33 nativespace-cdp sshd[857317]: Connection closed by 159.100.136.21 port 50484 [preauth]
Sep 12 02:00:59 nativespace-cdp sshd[858658]: Invalid user zhangxin from 89.46.223.32 port 58742
Sep 12 02:00:59 nativespace-cdp sshd[858658]: input_userauth_request: invalid user zhangxin [preauth]
Sep 12 02:00:59 nativespace-cdp sshd[858658]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:00:59 nativespace-cdp sshd[858658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.46.223.32
Sep 12 02:01:02 nativespace-cdp sshd[858658]: Failed password for invalid user zhangxin from 89.46.223.32 port 58742 ssh2
Sep 12 02:01:02 nativespace-cdp sshd[858658]: Received disconnect from 89.46.223.32 port 58742:11: Bye Bye [preauth]
Sep 12 02:01:02 nativespace-cdp sshd[858658]: Disconnected from 89.46.223.32 port 58742 [preauth]
Sep 12 02:01:35 nativespace-cdp sshd[858807]: Connection closed by 159.100.136.21 port 58772 [preauth]
Sep 12 02:02:20 nativespace-cdp sshd[858921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.190.53.154  user=root
Sep 12 02:02:20 nativespace-cdp sshd[858921]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 02:02:22 nativespace-cdp sshd[858921]: Failed password for root from 203.190.53.154 port 49346 ssh2
Sep 12 02:02:22 nativespace-cdp sshd[858921]: Received disconnect from 203.190.53.154 port 49346:11: Bye Bye [preauth]
Sep 12 02:02:22 nativespace-cdp sshd[858921]: Disconnected from 203.190.53.154 port 49346 [preauth]
Sep 12 02:03:09 nativespace-cdp sshd[859053]: Invalid user gadmin from 179.51.153.37 port 60722
Sep 12 02:03:09 nativespace-cdp sshd[859053]: input_userauth_request: invalid user gadmin [preauth]
Sep 12 02:03:09 nativespace-cdp sshd[859053]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:03:09 nativespace-cdp sshd[859053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.51.153.37
Sep 12 02:03:10 nativespace-cdp sshd[859053]: Failed password for invalid user gadmin from 179.51.153.37 port 60722 ssh2
Sep 12 02:03:11 nativespace-cdp sshd[859053]: Received disconnect from 179.51.153.37 port 60722:11: Bye Bye [preauth]
Sep 12 02:03:11 nativespace-cdp sshd[859053]: Disconnected from 179.51.153.37 port 60722 [preauth]
Sep 12 02:06:01 nativespace-cdp sshd[859736]: Invalid user monit from 156.236.75.85 port 57404
Sep 12 02:06:01 nativespace-cdp sshd[859736]: input_userauth_request: invalid user monit [preauth]
Sep 12 02:06:01 nativespace-cdp sshd[859736]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:06:01 nativespace-cdp sshd[859736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.236.75.85
Sep 12 02:06:03 nativespace-cdp sshd[859736]: Failed password for invalid user monit from 156.236.75.85 port 57404 ssh2
Sep 12 02:06:03 nativespace-cdp sshd[859736]: Received disconnect from 156.236.75.85 port 57404:11: Bye Bye [preauth]
Sep 12 02:06:03 nativespace-cdp sshd[859736]: Disconnected from 156.236.75.85 port 57404 [preauth]
Sep 12 02:06:35 nativespace-cdp sshd[859823]: Connection closed by 159.100.136.21 port 40054 [preauth]
Sep 12 02:09:05 nativespace-cdp sshd[860356]: Invalid user muhamed from 54.36.163.1 port 59508
Sep 12 02:09:05 nativespace-cdp sshd[860356]: input_userauth_request: invalid user muhamed [preauth]
Sep 12 02:09:05 nativespace-cdp sshd[860356]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:09:05 nativespace-cdp sshd[860356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.163.1
Sep 12 02:09:08 nativespace-cdp sshd[860356]: Failed password for invalid user muhamed from 54.36.163.1 port 59508 ssh2
Sep 12 02:09:15 nativespace-cdp sshd[860356]: Received disconnect from 54.36.163.1 port 59508:11: Bye Bye [preauth]
Sep 12 02:09:15 nativespace-cdp sshd[860356]: Disconnected from 54.36.163.1 port 59508 [preauth]
Sep 12 02:09:15 nativespace-cdp sshd[860382]: Invalid user sl from 89.46.223.32 port 52184
Sep 12 02:09:15 nativespace-cdp sshd[860382]: input_userauth_request: invalid user sl [preauth]
Sep 12 02:09:15 nativespace-cdp sshd[860382]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:09:15 nativespace-cdp sshd[860382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.46.223.32
Sep 12 02:09:17 nativespace-cdp sshd[860382]: Failed password for invalid user sl from 89.46.223.32 port 52184 ssh2
Sep 12 02:09:17 nativespace-cdp sshd[860382]: Received disconnect from 89.46.223.32 port 52184:11: Bye Bye [preauth]
Sep 12 02:09:17 nativespace-cdp sshd[860382]: Disconnected from 89.46.223.32 port 52184 [preauth]
Sep 12 02:09:35 nativespace-cdp sshd[860432]: Invalid user ai from 49.0.116.196 port 42481
Sep 12 02:09:35 nativespace-cdp sshd[860432]: input_userauth_request: invalid user ai [preauth]
Sep 12 02:09:35 nativespace-cdp sshd[860432]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:09:35 nativespace-cdp sshd[860432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.0.116.196
Sep 12 02:09:37 nativespace-cdp sshd[860432]: Failed password for invalid user ai from 49.0.116.196 port 42481 ssh2
Sep 12 02:09:37 nativespace-cdp sshd[860432]: Received disconnect from 49.0.116.196 port 42481:11: Bye Bye [preauth]
Sep 12 02:09:37 nativespace-cdp sshd[860432]: Disconnected from 49.0.116.196 port 42481 [preauth]
Sep 12 02:09:43 nativespace-cdp sshd[860446]: Invalid user anne from 156.236.75.85 port 60944
Sep 12 02:09:43 nativespace-cdp sshd[860446]: input_userauth_request: invalid user anne [preauth]
Sep 12 02:09:43 nativespace-cdp sshd[860446]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:09:43 nativespace-cdp sshd[860446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.236.75.85
Sep 12 02:09:45 nativespace-cdp sshd[860446]: Failed password for invalid user anne from 156.236.75.85 port 60944 ssh2
Sep 12 02:09:45 nativespace-cdp sshd[860446]: Received disconnect from 156.236.75.85 port 60944:11: Bye Bye [preauth]
Sep 12 02:09:45 nativespace-cdp sshd[860446]: Disconnected from 156.236.75.85 port 60944 [preauth]
Sep 12 02:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 02:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:51 nativespace-cdp sudo[860477]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 02:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:51 nativespace-cdp sudo[860480]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 02:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:51 nativespace-cdp sudo[860483]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 02:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:52 nativespace-cdp sudo[860488]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 02:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:54 nativespace-cdp sudo[860491]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 02:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:54 nativespace-cdp sudo[860501]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 02:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:54 nativespace-cdp sudo[860504]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 02:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:54 nativespace-cdp sudo[860507]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 02:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:54 nativespace-cdp sudo[860510]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 02:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:54 nativespace-cdp sudo[860513]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 02:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:54 nativespace-cdp sudo[860516]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:55 nativespace-cdp sshd[860520]: Invalid user admin from 89.46.223.32 port 58596
Sep 12 02:09:55 nativespace-cdp sshd[860520]: input_userauth_request: invalid user admin [preauth]
Sep 12 02:09:55 nativespace-cdp sshd[860520]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:09:55 nativespace-cdp sshd[860520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.46.223.32
Sep 12 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:56 nativespace-cdp sudo[860527]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:56 nativespace-cdp sudo[860532]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=brighto1 user-2=nstriton user-3=firstre2 user-4=vivienn1 user-5=battlere user-6=oneoarco user-7=bedfords user-8=ggaaorgu user-9=belle user-10=newstoda user-11=bemadonn user-12=alexadmin user-13=skyfirec user-14=innovat1 user-15=askhform user-16=stuartge user-17=nativene user-18=jonhartl user-19=seftvta user-20=ultbcrra user-21=firstres user-22=coursemc user-23=opaiscyx user-24=firstrel user-25=clarkass user-26=costestimatorco user-27=firstred user-28=southlon user-29=highlegh user-30=milloyco user-31=gilpin user-32=elecleis user-33=putterfi user-34=hubmaster user-35=carsinyo user-36=fetch user-37=accooper user-38=ianrayne user-39=connectedshoppin user-40=thqkgnbz user-41=brmrjxl user-42=lakesan1 user-43=strathar user-44=sarafoundation user-45=atestord user-46=wilsonsw user-47=musorguk
Sep 12 02:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=martsblo user-50=dickemery123 user-51=ptkxhsbt user-52=lbhyisi user-53=hhdugcor user-54=magichat user-55=booff user-56=markward user-57=foundation user-58=athenare user-59=connect9 user-60=vantagep user-61=maflemin user-62=lbscrmod user-63=ulsukarm user-64=jarvisin user-65=spectrum user-66=theblack user-67=hodgesonweb user-68=still user-69=agproduc user-70=stephani user-71=leereyn1 user-72=nove user-73=boldover user-74=bakery user-75=sosevalu user-76=crrtipdl user-77=tstardom user-78=oubpgvbx user-79=what user-80=sketchy user-81=cath user-82=havantho user-83=nvihkvu user-84=ladburyp user-85=dancinggardener user-86=stagingerris user-87=kategilpin user-88=design user-89=tomandle user-90=jennimil user-91=chrisdal user-92=mcdermos user-93=nbhavers user-94=careers user-95=david user-96=attlebor user-97=lucy user-98=onlycont user-99=outdoorc user-100=hodgsonmail user-101=ranxterc
Sep 12 02:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=branko user-103=romaldki user-104=putterfc user-105=nscdp user-106=health2045 user-107=fortunaz user-108=foods user-109=leftie user-110=lkpier user-111=ctedorgu user-112=philmcph user-113=firstre5 user-114=steakbridieme user-115=donnychicago user-116=isleofwi user-117=smrszyqg user-118=hidden user-119=nomistakes user-120=tigerlet user-121=barbersh user-122=cambria1 user-123=cathski user-124=reliable user-125=ninejimm user-126=pugwash user-127=paulmca1 user-128=howardon user-129=cwsocial user-130=hirefootballgame user-131=eugincou user-132=courseme user-133=sibtoncc user-134=asandcoc user-135=bwppodcast user-136=zebrapho user-137=steve user-138=burydropin user-139=fawcettd user-140=nsceres user-141=beauty user-142=eatspam user-143=darkstar user-144=dhyana feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 12 02:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 02:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:57 nativespace-cdp sudo[860536]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:57 nativespace-cdp sshd[860520]: Failed password for invalid user admin from 89.46.223.32 port 58596 ssh2
Sep 12 02:09:57 nativespace-cdp sshd[860520]: Received disconnect from 89.46.223.32 port 58596:11: Bye Bye [preauth]
Sep 12 02:09:57 nativespace-cdp sshd[860520]: Disconnected from 89.46.223.32 port 58596 [preauth]
Sep 12 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:57 nativespace-cdp sudo[860560]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UbRF0nYFE0FMgdix.~
Sep 12 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:57 nativespace-cdp sudo[860569]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UbRF0nYFE0FMgdix.~'
Sep 12 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:57 nativespace-cdp sudo[860572]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UbRF0nYFE0FMgdix.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:57 nativespace-cdp sudo[860576]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 02:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:57 nativespace-cdp sudo[860579]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:57 nativespace-cdp sshd[860539]: Invalid user openstack from 203.190.53.154 port 48128
Sep 12 02:09:57 nativespace-cdp sshd[860539]: input_userauth_request: invalid user openstack [preauth]
Sep 12 02:09:57 nativespace-cdp sshd[860539]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:09:57 nativespace-cdp sshd[860539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.190.53.154
Sep 12 02:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 02:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 02:09:58 nativespace-cdp sudo[860603]: pam_unix(sudo:session): session closed for user root
Sep 12 02:09:59 nativespace-cdp sshd[860539]: Failed password for invalid user openstack from 203.190.53.154 port 48128 ssh2
Sep 12 02:10:02 nativespace-cdp sshd[860539]: Received disconnect from 203.190.53.154 port 48128:11: Bye Bye [preauth]
Sep 12 02:10:02 nativespace-cdp sshd[860539]: Disconnected from 203.190.53.154 port 48128 [preauth]
Sep 12 02:10:39 nativespace-cdp sshd[860863]: Invalid user admin from 156.236.75.85 port 47668
Sep 12 02:10:39 nativespace-cdp sshd[860863]: input_userauth_request: invalid user admin [preauth]
Sep 12 02:10:39 nativespace-cdp sshd[860863]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:10:39 nativespace-cdp sshd[860863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.236.75.85
Sep 12 02:10:40 nativespace-cdp sshd[860869]: Invalid user gns3 from 179.51.153.37 port 37358
Sep 12 02:10:40 nativespace-cdp sshd[860869]: input_userauth_request: invalid user gns3 [preauth]
Sep 12 02:10:40 nativespace-cdp sshd[860869]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:10:40 nativespace-cdp sshd[860869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.51.153.37
Sep 12 02:10:40 nativespace-cdp sshd[860863]: Failed password for invalid user admin from 156.236.75.85 port 47668 ssh2
Sep 12 02:10:40 nativespace-cdp sshd[860863]: Received disconnect from 156.236.75.85 port 47668:11: Bye Bye [preauth]
Sep 12 02:10:40 nativespace-cdp sshd[860863]: Disconnected from 156.236.75.85 port 47668 [preauth]
Sep 12 02:10:42 nativespace-cdp sshd[860869]: Failed password for invalid user gns3 from 179.51.153.37 port 37358 ssh2
Sep 12 02:10:43 nativespace-cdp sshd[860869]: Received disconnect from 179.51.153.37 port 37358:11: Bye Bye [preauth]
Sep 12 02:10:43 nativespace-cdp sshd[860869]: Disconnected from 179.51.153.37 port 37358 [preauth]
Sep 12 02:10:43 nativespace-cdp sshd[860879]: Invalid user student from 203.190.53.154 port 60930
Sep 12 02:10:43 nativespace-cdp sshd[860879]: input_userauth_request: invalid user student [preauth]
Sep 12 02:10:43 nativespace-cdp sshd[860879]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:10:43 nativespace-cdp sshd[860879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.190.53.154
Sep 12 02:10:46 nativespace-cdp sshd[860879]: Failed password for invalid user student from 203.190.53.154 port 60930 ssh2
Sep 12 02:10:46 nativespace-cdp sshd[860879]: Received disconnect from 203.190.53.154 port 60930:11: Bye Bye [preauth]
Sep 12 02:10:46 nativespace-cdp sshd[860879]: Disconnected from 203.190.53.154 port 60930 [preauth]
Sep 12 02:10:59 nativespace-cdp sshd[860971]: Invalid user gadmin from 54.36.163.1 port 49034
Sep 12 02:10:59 nativespace-cdp sshd[860971]: input_userauth_request: invalid user gadmin [preauth]
Sep 12 02:10:59 nativespace-cdp sshd[860971]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:10:59 nativespace-cdp sshd[860971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.163.1
Sep 12 02:11:01 nativespace-cdp sshd[860971]: Failed password for invalid user gadmin from 54.36.163.1 port 49034 ssh2
Sep 12 02:11:01 nativespace-cdp sshd[860971]: Received disconnect from 54.36.163.1 port 49034:11: Bye Bye [preauth]
Sep 12 02:11:01 nativespace-cdp sshd[860971]: Disconnected from 54.36.163.1 port 49034 [preauth]
Sep 12 02:11:13 nativespace-cdp sshd[861006]: Invalid user gadmin from 49.0.116.196 port 23146
Sep 12 02:11:13 nativespace-cdp sshd[861006]: input_userauth_request: invalid user gadmin [preauth]
Sep 12 02:11:13 nativespace-cdp sshd[861006]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:11:13 nativespace-cdp sshd[861006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.0.116.196
Sep 12 02:11:15 nativespace-cdp sshd[861006]: Failed password for invalid user gadmin from 49.0.116.196 port 23146 ssh2
Sep 12 02:11:15 nativespace-cdp sshd[861006]: Received disconnect from 49.0.116.196 port 23146:11: Bye Bye [preauth]
Sep 12 02:11:15 nativespace-cdp sshd[861006]: Disconnected from 49.0.116.196 port 23146 [preauth]
Sep 12 02:11:35 nativespace-cdp sshd[861190]: Connection closed by 159.100.136.21 port 49160 [preauth]
Sep 12 02:11:37 nativespace-cdp sshd[861192]: Invalid user debug from 179.51.153.37 port 52214
Sep 12 02:11:37 nativespace-cdp sshd[861192]: input_userauth_request: invalid user debug [preauth]
Sep 12 02:11:37 nativespace-cdp sshd[861192]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:11:37 nativespace-cdp sshd[861192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.51.153.37
Sep 12 02:11:37 nativespace-cdp sshd[861215]: Invalid user nas from 54.36.163.1 port 35968
Sep 12 02:11:37 nativespace-cdp sshd[861215]: input_userauth_request: invalid user nas [preauth]
Sep 12 02:11:37 nativespace-cdp sshd[861215]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:11:37 nativespace-cdp sshd[861215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.163.1
Sep 12 02:11:39 nativespace-cdp sshd[861192]: Failed password for invalid user debug from 179.51.153.37 port 52214 ssh2
Sep 12 02:11:40 nativespace-cdp sshd[861215]: Failed password for invalid user nas from 54.36.163.1 port 35968 ssh2
Sep 12 02:11:40 nativespace-cdp sshd[861215]: Received disconnect from 54.36.163.1 port 35968:11: Bye Bye [preauth]
Sep 12 02:11:40 nativespace-cdp sshd[861215]: Disconnected from 54.36.163.1 port 35968 [preauth]
Sep 12 02:12:02 nativespace-cdp sshd[861295]: Invalid user test from 49.0.116.196 port 7425
Sep 12 02:12:02 nativespace-cdp sshd[861295]: input_userauth_request: invalid user test [preauth]
Sep 12 02:12:02 nativespace-cdp sshd[861295]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 02:12:02 nativespace-cdp sshd[861295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.0.116.196
Sep 12 02:12:04 nativespace-cdp sshd[861295]: Failed password for invalid user test from 49.0.116.196 port 7425 ssh2
Sep 12 02:12:04 nativespace-cdp sshd[861295]: Received disconnect from 49.0.116.196 port 7425:11: Bye Bye [preauth]
Sep 12 02:12:04 nativespace-cdp sshd[861295]: Disconnected from 49.0.116.196 port 7425 [preauth]
Sep 12 02:16:33 nativespace-cdp sshd[862397]: Connection closed by 159.100.136.21 port 58888 [preauth]
Sep 12 02:21:33 nativespace-cdp sshd[863874]: Connection closed by 159.100.136.21 port 39670 [preauth]
Sep 12 02:26:33 nativespace-cdp sshd[865149]: Connection closed by 159.100.136.21 port 49416 [preauth]
Sep 12 02:31:33 nativespace-cdp sshd[866366]: Connection closed by 159.100.136.21 port 58658 [preauth]
Sep 12 02:36:33 nativespace-cdp sshd[867422]: Connection closed by 159.100.136.21 port 39214 [preauth]
Sep 12 02:41:33 nativespace-cdp sshd[868503]: Connection closed by 159.100.136.21 port 48226 [preauth]
Sep 12 02:46:35 nativespace-cdp sshd[869622]: Connection closed by 159.100.136.21 port 57814 [preauth]
Sep 12 02:51:33 nativespace-cdp sshd[870827]: Connection closed by 159.100.136.21 port 39108 [preauth]
Sep 12 02:56:33 nativespace-cdp sshd[872414]: Connection closed by 159.100.136.21 port 49256 [preauth]
Sep 12 03:01:33 nativespace-cdp sshd[873649]: Connection closed by 159.100.136.21 port 58822 [preauth]
Sep 12 03:06:33 nativespace-cdp sshd[874729]: Connection closed by 159.100.136.21 port 40096 [preauth]
Sep 12 03:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 03:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:50 nativespace-cdp sudo[875315]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 03:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:50 nativespace-cdp sudo[875318]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 03:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:50 nativespace-cdp sudo[875321]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 03:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:51 nativespace-cdp sudo[875326]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 03:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:52 nativespace-cdp sudo[875329]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:52 nativespace-cdp sudo[875336]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:52 nativespace-cdp sudo[875339]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:52 nativespace-cdp sudo[875342]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:52 nativespace-cdp sudo[875345]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:52 nativespace-cdp sudo[875348]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 03:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:52 nativespace-cdp sudo[875351]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 03:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:56 nativespace-cdp sudo[875373]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 03:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:56 nativespace-cdp sudo[875377]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=lbscrmod user-3=maflemin user-4=vantagep user-5=athenare user-6=connect9 user-7=booff user-8=markward user-9=foundation user-10=leereyn1 user-11=stephani user-12=agproduc user-13=still user-14=hodgesonweb user-15=theblack user-16=spectrum user-17=jarvisin user-18=megacards user-19=musorguk user-20=wilsonsw user-21=atestord user-22=sarafoundation user-23=strathar user-24=lakesan1 user-25=brmrjxl user-26=magichat user-27=hhdugcor user-28=lbhyisi user-29=ptkxhsbt user-30=dickemery123 user-31=martsblo user-32=highlegh user-33=southlon user-34=firstred user-35=costestimatorco user-36=clarkass user-37=firstrel user-38=coursemc user-39=opaiscyx user-40=firstres user-41=ultbcrra user-42=seftvta user-43=jonhartl user-44=thqkgnbz user-45=connectedshoppin user-46=ianrayne user-47=accooper
Sep 12 03:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=fetch user-49=carsinyo user-50=hubmaster user-51=putterfi user-52=elecleis user-53=milloyco user-54=gilpin user-55=bemadonn user-56=newstoda user-57=belle user-58=ggaaorgu user-59=bedfords user-60=oneoarco user-61=battlere user-62=vivienn1 user-63=firstre2 user-64=nstriton user-65=brighto1 user-66=nativene user-67=askhform user-68=stuartge user-69=innovat1 user-70=skyfirec user-71=alexadmin user-72=steve user-73=zebrapho user-74=bwppodcast user-75=asandcoc user-76=sibtoncc user-77=dhyana user-78=darkstar user-79=eatspam user-80=beauty user-81=nsceres user-82=fawcettd user-83=burydropin user-84=barbersh user-85=tigerlet user-86=nomistakes user-87=hidden user-88=smrszyqg user-89=isleofwi user-90=donnychicago user-91=firstre5 user-92=steakbridieme user-93=ctedorgu user-94=philmcph user-95=lkpier user-96=foods user-97=leftie user-98=fortunaz user-99=health2045 user-100=nscdp user-101=putterfc
Sep 12 03:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=courseme user-103=eugincou user-104=hirefootballgame user-105=cwsocial user-106=pugwash user-107=howardon user-108=paulmca1 user-109=ninejimm user-110=reliable user-111=cambria1 user-112=cathski user-113=david user-114=careers user-115=nbhavers user-116=mcdermos user-117=chrisdal user-118=jennimil user-119=tomandle user-120=romaldki user-121=branko user-122=ranxterc user-123=hodgsonmail user-124=outdoorc user-125=onlycont user-126=lucy user-127=attlebor user-128=crrtipdl user-129=sosevalu user-130=bakery user-131=boldover user-132=nove user-133=design user-134=kategilpin user-135=dancinggardener user-136=stagingerris user-137=ladburyp user-138=nvihkvu user-139=havantho user-140=sketchy user-141=cath user-142=what user-143=tstardom user-144=oubpgvbx feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 03:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 03:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:56 nativespace-cdp sudo[875381]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 03:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:56 nativespace-cdp sudo[875385]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-C1tN8zmA1a2zxoZL.~
Sep 12 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:57 nativespace-cdp sudo[875389]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-C1tN8zmA1a2zxoZL.~'
Sep 12 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:57 nativespace-cdp sudo[875392]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-C1tN8zmA1a2zxoZL.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:57 nativespace-cdp sudo[875396]: pam_unix(sudo:session): session closed for user root
Sep 12 03:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 03:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:09:57 nativespace-cdp sudo[875399]: pam_unix(sudo:session): session closed for user root
Sep 12 03:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 03:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 03:10:03 nativespace-cdp sudo[875544]: pam_unix(sudo:session): session closed for user root
Sep 12 03:11:33 nativespace-cdp sshd[875816]: Connection closed by 159.100.136.21 port 46746 [preauth]
Sep 12 03:16:33 nativespace-cdp sshd[877402]: Connection closed by 159.100.136.21 port 54924 [preauth]
Sep 12 03:21:37 nativespace-cdp sshd[878654]: Connection closed by 159.100.136.21 port 36074 [preauth]
Sep 12 03:26:33 nativespace-cdp sshd[880112]: Connection closed by 159.100.136.21 port 45496 [preauth]
Sep 12 03:31:33 nativespace-cdp sshd[881581]: Connection closed by 159.100.136.21 port 54704 [preauth]
Sep 12 03:36:33 nativespace-cdp sshd[882543]: Connection closed by 159.100.136.21 port 35280 [preauth]
Sep 12 03:41:34 nativespace-cdp sshd[884226]: Connection closed by 159.100.136.21 port 44062 [preauth]
Sep 12 03:46:33 nativespace-cdp sshd[885335]: Connection closed by 159.100.136.21 port 53832 [preauth]
Sep 12 03:51:33 nativespace-cdp sshd[886371]: Connection closed by 159.100.136.21 port 35194 [preauth]
Sep 12 03:56:35 nativespace-cdp sshd[887656]: Connection closed by 159.100.136.21 port 44334 [preauth]
Sep 12 04:01:33 nativespace-cdp sshd[888953]: Connection closed by 159.100.136.21 port 53516 [preauth]
Sep 12 04:06:33 nativespace-cdp sshd[890030]: Connection closed by 159.100.136.21 port 35132 [preauth]
Sep 12 04:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 04:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:09:56 nativespace-cdp sudo[890676]: pam_unix(sudo:session): session closed for user root
Sep 12 04:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 04:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:09:56 nativespace-cdp sudo[890679]: pam_unix(sudo:session): session closed for user root
Sep 12 04:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 04:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:09:57 nativespace-cdp sudo[890682]: pam_unix(sudo:session): session closed for user root
Sep 12 04:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 04:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:09:57 nativespace-cdp sudo[890687]: pam_unix(sudo:session): session closed for user root
Sep 12 04:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 04:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:00 nativespace-cdp sudo[890690]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 04:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:00 nativespace-cdp sudo[890702]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 04:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:01 nativespace-cdp sudo[890706]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 04:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:01 nativespace-cdp sudo[890709]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 04:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:01 nativespace-cdp sudo[890713]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 04:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:01 nativespace-cdp sudo[890717]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 04:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:01 nativespace-cdp sudo[890720]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 04:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:04 nativespace-cdp sudo[890860]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 04:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:05 nativespace-cdp sudo[890864]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=eugincou user-2=courseme user-3=hirefootballgame user-4=pugwash user-5=paulmca1 user-6=howardon user-7=cwsocial user-8=cathski user-9=cambria1 user-10=reliable user-11=ninejimm user-12=hidden user-13=nomistakes user-14=tigerlet user-15=barbersh user-16=isleofwi user-17=smrszyqg user-18=lkpier user-19=ctedorgu user-20=philmcph user-21=donnychicago user-22=steakbridieme user-23=firstre5 user-24=putterfc user-25=nscdp user-26=fortunaz user-27=health2045 user-28=leftie user-29=foods user-30=dhyana user-31=beauty user-32=eatspam user-33=darkstar user-34=nsceres user-35=burydropin user-36=fawcettd user-37=steve user-38=bwppodcast user-39=zebrapho user-40=sibtoncc user-41=asandcoc user-42=design user-43=ladburyp user-44=stagingerris user-45=dancinggardener user-46=kategilpin user-47=sketchy
Sep 12 04:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=cath user-49=havantho user-50=nvihkvu user-51=oubpgvbx user-52=tstardom user-53=what user-54=bakery user-55=sosevalu user-56=crrtipdl user-57=boldover user-58=nove user-59=romaldki user-60=outdoorc user-61=hodgsonmail user-62=ranxterc user-63=branko user-64=onlycont user-65=attlebor user-66=lucy user-67=careers user-68=nbhavers user-69=david user-70=chrisdal user-71=mcdermos user-72=jennimil user-73=tomandle user-74=magichat user-75=lbhyisi user-76=hhdugcor user-77=dickemery123 user-78=ptkxhsbt user-79=martsblo user-80=musorguk user-81=megacards user-82=wilsonsw user-83=strathar user-84=sarafoundation user-85=atestord user-86=brmrjxl user-87=lakesan1 user-88=stephani user-89=leereyn1 user-90=still user-91=agproduc user-92=spectrum user-93=theblack user-94=hodgesonweb user-95=jarvisin user-96=ulsukarm user-97=connect9 user-98=athenare user-99=vantagep user-100=maflemin user-101=lbscrmod user-102=markward
Sep 12 04:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=booff user-104=foundation user-105=nativene user-106=innovat1 user-107=stuartge user-108=askhform user-109=alexadmin user-110=skyfirec user-111=ggaaorgu user-112=belle user-113=newstoda user-114=bemadonn user-115=bedfords user-116=firstre2 user-117=vivienn1 user-118=battlere user-119=oneoarco user-120=brighto1 user-121=nstriton user-122=connectedshoppin user-123=thqkgnbz user-124=accooper user-125=ianrayne user-126=putterfi user-127=hubmaster user-128=carsinyo user-129=fetch user-130=gilpin user-131=milloyco user-132=elecleis user-133=firstred user-134=southlon user-135=highlegh user-136=firstrel user-137=clarkass user-138=costestimatorco user-139=opaiscyx user-140=coursemc user-141=seftvta user-142=jonhartl user-143=ultbcrra user-144=firstres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 04:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 04:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:07 nativespace-cdp sudo[890885]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 04:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:09 nativespace-cdp sudo[890919]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-MRyD35Uns0ddJAUR.~
Sep 12 04:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:09 nativespace-cdp sudo[890924]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-MRyD35Uns0ddJAUR.~'
Sep 12 04:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:09 nativespace-cdp sudo[890927]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-MRyD35Uns0ddJAUR.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 04:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:09 nativespace-cdp sudo[890931]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 04:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:09 nativespace-cdp sudo[890934]: pam_unix(sudo:session): session closed for user root
Sep 12 04:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 04:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:10:11 nativespace-cdp sudo[890953]: pam_unix(sudo:session): session closed for user root
Sep 12 04:11:33 nativespace-cdp sshd[891308]: Connection closed by 159.100.136.21 port 44382 [preauth]
Sep 12 04:16:33 nativespace-cdp sshd[892698]: Connection closed by 159.100.136.21 port 52698 [preauth]
Sep 12 04:21:36 nativespace-cdp sshd[893892]: Connection closed by 159.100.136.21 port 33062 [preauth]
Sep 12 04:26:33 nativespace-cdp sshd[894888]: Connection closed by 159.100.136.21 port 41482 [preauth]
Sep 12 04:30:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 04:30:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:30:04 nativespace-cdp sudo[895895]: pam_unix(sudo:session): session closed for user root
Sep 12 04:31:33 nativespace-cdp sshd[896252]: Connection closed by 159.100.136.21 port 50728 [preauth]
Sep 12 04:36:34 nativespace-cdp sshd[898926]: Connection closed by 159.100.136.21 port 59432 [preauth]
Sep 12 04:41:32 nativespace-cdp sshd[901457]: Connection closed by 159.100.136.21 port 39734 [preauth]
Sep 12 04:46:33 nativespace-cdp sshd[903052]: Connection closed by 159.100.136.21 port 49018 [preauth]
Sep 12 04:51:34 nativespace-cdp sshd[904068]: Connection closed by 159.100.136.21 port 57978 [preauth]
Sep 12 04:56:34 nativespace-cdp sshd[905411]: Connection closed by 159.100.136.21 port 38252 [preauth]
Sep 12 04:56:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 04:56:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:56:55 nativespace-cdp sudo[905469]: pam_unix(sudo:session): session closed for user root
Sep 12 04:56:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 04:56:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:56:56 nativespace-cdp sudo[905477]: pam_unix(sudo:session): session closed for user root
Sep 12 04:56:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 04:56:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:00 nativespace-cdp sudo[905489]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=seftvta user-2=jonhartl user-3=ultbcrra user-4=firstres user-5=coursemc user-6=opaiscyx user-7=firstrel user-8=clarkass user-9=costestimatorco user-10=firstred user-11=southlon user-12=highlegh user-13=gilpin user-14=milloyco user-15=elecleis user-16=putterfi user-17=hubmaster user-18=carsinyo user-19=fetch user-20=accooper user-21=ianrayne user-22=connectedshoppin user-23=thqkgnbz user-24=brighto1 user-25=nstriton user-26=firstre2 user-27=vivienn1 user-28=battlere user-29=oneoarco user-30=bedfords user-31=ggaaorgu user-32=belle user-33=newstoda user-34=bemadonn user-35=alexadmin user-36=skyfirec user-37=innovat1 user-38=askhform user-39=stuartge user-40=nativene user-41=markward user-42=booff user-43=foundation user-44=connect9 user-45=athenare user-46=vantagep user-47=maflemin user-48=lbscrmod
Sep 12 04:57:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=jarvisin user-51=spectrum user-52=hodgesonweb user-53=theblack user-54=still user-55=agproduc user-56=stephani user-57=leereyn1 user-58=brmrjxl user-59=lakesan1 user-60=strathar user-61=sarafoundation user-62=atestord user-63=wilsonsw user-64=musorguk user-65=megacards user-66=martsblo user-67=dickemery123 user-68=ptkxhsbt user-69=lbhyisi user-70=hhdugcor user-71=magichat user-72=tomandle user-73=jennimil user-74=chrisdal user-75=mcdermos user-76=careers user-77=nbhavers user-78=david user-79=attlebor user-80=lucy user-81=onlycont user-82=ranxterc user-83=hodgsonmail user-84=outdoorc user-85=branko user-86=romaldki user-87=nove user-88=boldover user-89=bakery user-90=sosevalu user-91=crrtipdl user-92=tstardom user-93=oubpgvbx user-94=what user-95=sketchy user-96=cath user-97=havantho user-98=nvihkvu user-99=ladburyp user-100=dancinggardener user-101=stagingerris user-102=kategilpin
Sep 12 04:57:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=design user-104=asandcoc user-105=sibtoncc user-106=bwppodcast user-107=zebrapho user-108=steve user-109=burydropin user-110=fawcettd user-111=nsceres user-112=beauty user-113=eatspam user-114=darkstar user-115=dhyana user-116=putterfc user-117=nscdp user-118=fortunaz user-119=health2045 user-120=leftie user-121=foods user-122=lkpier user-123=ctedorgu user-124=philmcph user-125=steakbridieme user-126=donnychicago user-127=firstre5 user-128=isleofwi user-129=smrszyqg user-130=hidden user-131=nomistakes user-132=tigerlet user-133=barbersh user-134=cambria1 user-135=cathski user-136=ninejimm user-137=reliable user-138=howardon user-139=pugwash user-140=paulmca1 user-141=cwsocial user-142=hirefootballgame user-143=eugincou user-144=courseme feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 04:57:00 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 04:57:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:01 nativespace-cdp sudo[905497]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 12 04:57:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:02 nativespace-cdp sudo[905567]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=onlycont --output=json
Sep 12 04:57:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:03 nativespace-cdp sudo[905575]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 12 04:57:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 04:57:30 nativespace-cdp sudo[905808]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 04:57:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user onlycont --user-current --json
Sep 12 04:57:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:31 nativespace-cdp sudo[905814]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont LangPHP php_get_vhost_versions --output=json
Sep 12 04:57:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:33 nativespace-cdp sudo[905824]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep 12 04:57:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:35 nativespace-cdp sudo[905830]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 12 04:57:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:35 nativespace-cdp sudo[905838]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DomainInfo single_domain_data domain=apexred.com return_https_redirect_status=1 --output=json
Sep 12 04:57:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:37 nativespace-cdp sudo[905857]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep 12 04:57:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:41 nativespace-cdp sudo[905929]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep 12 04:57:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:42 nativespace-cdp sudo[905963]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont Mime list_redirects --output=json
Sep 12 04:57:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:42 nativespace-cdp sudo[905969]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DirectoryPrivacy is_directory_protected dir=/home/onlycont/public_html/wp --output=json
Sep 12 04:57:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:57:46 nativespace-cdp sudo[906031]: pam_unix(sudo:session): session closed for user root
Sep 12 04:57:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 12 04:57:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 04:57:48 nativespace-cdp sudo[906088]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 04:57:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 12 04:57:48 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 12 04:57:48 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 12 04:57:48 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:57:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 04:57:49 nativespace-cdp sudo[906095]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 04:57:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 12 04:57:49 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 12 04:57:49 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 12 04:57:49 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:57:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 04:57:51 nativespace-cdp sudo[906103]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 04:57:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 12 04:57:51 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 12 04:57:51 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 12 04:57:51 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:57:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 04:57:52 nativespace-cdp sudo[906110]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 12 04:58:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 04:58:01 nativespace-cdp sudo[906238]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:58:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 04:58:01 nativespace-cdp sudo[906244]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:58:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 04:58:01 nativespace-cdp sudo[906249]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 12 04:58:01 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:58:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 04:58:01 nativespace-cdp sudo[906256]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 04:58:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 04:58:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:58:04 nativespace-cdp sudo[906291]: pam_unix(sudo:session): session closed for user root
Sep 12 04:58:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep 12 04:58:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:58:04 nativespace-cdp sudo[906300]: pam_unix(sudo:session): session closed for user root
Sep 12 04:58:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 12 04:58:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 04:58:25 nativespace-cdp sudo[906393]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 04:58:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 12 04:58:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:58:26 nativespace-cdp sudo[906399]: pam_unix(sudo:session): session closed for user root
Sep 12 04:58:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep 12 04:58:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:58:26 nativespace-cdp sudo[906404]: pam_unix(sudo:session): session closed for user root
Sep 12 04:58:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep 12 04:58:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:58:27 nativespace-cdp sudo[906409]: pam_unix(sudo:session): session closed for user root
Sep 12 04:58:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 12 04:58:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:58:27 nativespace-cdp sudo[906422]: pam_unix(sudo:session): session closed for user root
Sep 12 04:58:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep 12 04:58:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:58:30 nativespace-cdp sudo[906437]: pam_unix(sudo:session): session closed for user root
Sep 12 04:58:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep 12 04:58:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:58:30 nativespace-cdp sudo[906442]: pam_unix(sudo:session): session closed for user root
Sep 12 04:58:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep 12 04:58:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:58:39 nativespace-cdp sudo[906517]: pam_unix(sudo:session): session closed for user root
Sep 12 04:58:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 12 04:58:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 04:58:42 nativespace-cdp sudo[906577]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 04:58:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 12 04:58:42 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 12 04:58:42 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 12 04:58:42 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:58:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 04:58:42 nativespace-cdp sudo[906583]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 04:58:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 12 04:58:43 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 12 04:58:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 12 04:58:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:58:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 04:59:06 nativespace-cdp sudo[906590]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 04:59:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 12 04:59:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 04:59:14 nativespace-cdp sudo[906753]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 04:59:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 12 04:59:14 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 12 04:59:14 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 12 04:59:14 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:59:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 04:59:14 nativespace-cdp sudo[906759]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 04:59:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 12 04:59:14 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 12 04:59:14 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 12 04:59:14 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 04:59:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 04:59:14 nativespace-cdp sudo[906766]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 04:59:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 12 04:59:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:59:17 nativespace-cdp sudo[906804]: pam_unix(sudo:session): session closed for user root
Sep 12 04:59:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep 12 04:59:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 04:59:17 nativespace-cdp sudo[906812]: pam_unix(sudo:session): session closed for user root
Sep 12 05:00:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 12 05:00:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 05:00:08 nativespace-cdp sudo[907159]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 05:00:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep 12 05:00:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:00:08 nativespace-cdp sudo[907165]: pam_unix(sudo:session): session closed for user root
Sep 12 05:00:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep 12 05:00:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:00:09 nativespace-cdp sudo[907170]: pam_unix(sudo:session): session closed for user root
Sep 12 05:00:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 12 05:00:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:00:09 nativespace-cdp sudo[907176]: pam_unix(sudo:session): session closed for user root
Sep 12 05:00:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep 12 05:00:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:00:10 nativespace-cdp sudo[907188]: pam_unix(sudo:session): session closed for user root
Sep 12 05:00:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep 12 05:00:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:00:10 nativespace-cdp sudo[907194]: pam_unix(sudo:session): session closed for user root
Sep 12 05:00:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep 12 05:00:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:00:24 nativespace-cdp sudo[907284]: pam_unix(sudo:session): session closed for user root
Sep 12 05:00:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 12 05:00:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 05:00:28 nativespace-cdp sudo[907356]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 05:00:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 12 05:00:28 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 12 05:00:28 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 12 05:00:28 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:00:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 05:00:28 nativespace-cdp sudo[907362]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 05:00:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 12 05:00:28 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 12 05:00:28 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 12 05:00:28 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:00:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 05:00:42 nativespace-cdp sudo[907369]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 05:00:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 12 05:00:42 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 12 05:00:42 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 12 05:00:42 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:00:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 05:00:43 nativespace-cdp sudo[907481]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 12 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 05:00:57 nativespace-cdp sudo[907621]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 05:00:57 nativespace-cdp sudo[907627]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 05:00:57 nativespace-cdp sudo[907633]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 12 05:00:57 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:00:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 05:00:57 nativespace-cdp sudo[907639]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 05:00:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 12 05:00:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:00 nativespace-cdp sudo[907674]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep 12 05:01:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:01 nativespace-cdp sudo[907680]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep 12 05:01:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:03 nativespace-cdp sudo[907722]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep 12 05:01:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:03 nativespace-cdp sudo[907733]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 12 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 12 05:01:04 nativespace-cdp sudo[907745]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 12 05:01:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep 12 05:01:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:05 nativespace-cdp sudo[907752]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep 12 05:01:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:05 nativespace-cdp sudo[907757]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 12 05:01:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:05 nativespace-cdp sudo[907761]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 12 05:01:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 05:01:22 nativespace-cdp sudo[907842]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 05:01:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 12 05:01:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:23 nativespace-cdp sudo[907852]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 12 05:01:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:23 nativespace-cdp sudo[907857]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep 12 05:01:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:25 nativespace-cdp sudo[907870]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep 12 05:01:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:01:29 nativespace-cdp sudo[907954]: pam_unix(sudo:session): session closed for user root
Sep 12 05:01:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 12 05:01:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 05:01:32 nativespace-cdp sudo[908015]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 05:01:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 12 05:01:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 12 05:01:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 12 05:01:32 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:01:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 05:01:34 nativespace-cdp sudo[908021]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 05:01:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 12 05:01:34 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 12 05:01:34 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 12 05:01:34 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:01:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 05:01:35 nativespace-cdp sshd[908036]: Connection closed by 159.100.136.21 port 47520 [preauth]
Sep 12 05:01:52 nativespace-cdp sudo[908029]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 12 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 05:01:58 nativespace-cdp sudo[908166]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 12 05:01:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 12 05:01:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 12 05:01:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 05:01:58 nativespace-cdp sudo[908172]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 05:01:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 12 05:01:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 12 05:01:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 12 05:01:58 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 12 05:01:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 05:01:58 nativespace-cdp sudo[908178]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 12 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:00 nativespace-cdp sudo[908215]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep 12 05:02:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:01 nativespace-cdp sudo[908222]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 12 05:02:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 12 05:02:27 nativespace-cdp sudo[908334]: pam_unix(sudo:session): session closed for user fortunaz
Sep 12 05:02:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep 12 05:02:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:27 nativespace-cdp sudo[908341]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep 12 05:02:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:28 nativespace-cdp sudo[908345]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 12 05:02:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:28 nativespace-cdp sudo[908349]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep 12 05:02:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:30 nativespace-cdp sudo[908367]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep 12 05:02:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:31 nativespace-cdp sudo[908374]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep 12 05:02:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:39 nativespace-cdp sudo[908525]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=seftvta WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "Fluent Forms" on ONE | OAR (https://oneoar.co.uk). Installed version: 4.3.22. Available version: 5.2.2.<br/><br/>' installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep 12 05:02:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:51 nativespace-cdp sudo[908730]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908852]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908856]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908859]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908862]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908865]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908868]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908871]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908874]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908877]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908880]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908883]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908886]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908889]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908892]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:02:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:58 nativespace-cdp sudo[908895]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908898]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908901]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908904]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908907]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908910]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908914]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908917]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908920]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908923]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908926]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908929]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908932]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908935]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908938]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908941]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908945]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908948]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908951]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908954]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908957]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908960]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908963]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908966]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908969]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908972]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908975]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908978]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908981]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908984]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908987]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908990]: pam_unix(sudo:session): session closed for user root
Sep 12 05:02:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:02:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:02:59 nativespace-cdp sudo[908993]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[908996]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[908999]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909002]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909005]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909008]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909011]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909015]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909018]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909021]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909024]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909027]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909030]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909033]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909036]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909039]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909042]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909045]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909048]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909051]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909054]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909057]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909060]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909063]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909066]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909069]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909072]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909075]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909078]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909081]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909084]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909087]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909090]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:00 nativespace-cdp sudo[909093]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909096]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909099]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909102]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909105]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909108]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909111]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909115]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909118]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909121]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909124]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909127]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909130]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909133]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909146]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909151]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909154]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909157]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909160]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909163]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909166]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909170]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909173]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909176]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909179]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909183]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909186]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909189]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 12 05:03:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:01 nativespace-cdp sudo[909192]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909196]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909199]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909202]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909205]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909208]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909211]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909216]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909220]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909224]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909227]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909230]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909233]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909236]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909239]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909242]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909245]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909249]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909252]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909255]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909258]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909261]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909264]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909267]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909270]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909273]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909276]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909279]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909282]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909285]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909288]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909291]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909294]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909297]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909300]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909304]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909307]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 12 05:03:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:02 nativespace-cdp sudo[909311]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909314]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909317]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909320]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909323]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909326]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909329]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909332]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909335]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909339]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909342]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909345]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909350]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909353]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909356]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909359]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909362]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909365]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909368]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909371]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909374]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909377]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909380]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909383]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909386]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909389]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909392]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909395]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909398]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909401]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909404]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909407]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909411]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909414]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:03 nativespace-cdp sudo[909417]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909420]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909423]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909426]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909429]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909432]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909435]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909438]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909441]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909445]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909448]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909451]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909454]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909457]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909460]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909463]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909466]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909469]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909472]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909475]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909478]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909481]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909484]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909487]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909490]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909493]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909496]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909499]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909502]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909505]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909508]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909511]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909514]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909517]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909520]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909523]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909526]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909529]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 12 05:03:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:04 nativespace-cdp sudo[909532]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 12 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:05 nativespace-cdp sudo[909535]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 12 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:05 nativespace-cdp sudo[909538]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 12 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:05 nativespace-cdp sudo[909541]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 12 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:05 nativespace-cdp sudo[909544]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 12 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:05 nativespace-cdp sudo[909547]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 12 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:05 nativespace-cdp sudo[909550]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 12 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:05 nativespace-cdp sudo[909553]: pam_unix(sudo:session): session closed for user root
Sep 12 05:03:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 12 05:03:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:03:05 nativespace-cdp sudo[909557]: pam_unix(sudo:session): session closed for user root
Sep 12 05:06:35 nativespace-cdp sshd[910276]: Connection closed by 159.100.136.21 port 56774 [preauth]
Sep 12 05:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 05:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:53 nativespace-cdp sudo[910863]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 05:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:53 nativespace-cdp sudo[910866]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:54 nativespace-cdp sudo[910869]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:54 nativespace-cdp sudo[910874]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 05:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:56 nativespace-cdp sudo[910877]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 05:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:56 nativespace-cdp sudo[910886]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 05:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:56 nativespace-cdp sudo[910889]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 05:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:56 nativespace-cdp sudo[910893]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 05:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:56 nativespace-cdp sudo[910897]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 05:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:56 nativespace-cdp sudo[910900]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 05:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:56 nativespace-cdp sudo[910904]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 05:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:58 nativespace-cdp sudo[910915]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 05:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:59 nativespace-cdp sudo[910920]: pam_unix(sudo:session): session closed for user root
Sep 12 05:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lkpier user-2=donnychicago user-3=steakbridieme user-4=firstre5 user-5=ctedorgu user-6=philmcph user-7=nscdp user-8=putterfc user-9=foods user-10=leftie user-11=health2045 user-12=fortunaz user-13=nomistakes user-14=hidden user-15=tigerlet user-16=barbersh user-17=smrszyqg user-18=isleofwi user-19=cwsocial user-20=paulmca1 user-21=pugwash user-22=howardon user-23=cathski user-24=cambria1 user-25=reliable user-26=ninejimm user-27=eugincou user-28=courseme user-29=hirefootballgame user-30=sibtoncc user-31=asandcoc user-32=steve user-33=bwppodcast user-34=zebrapho user-35=nsceres user-36=fawcettd user-37=burydropin user-38=dhyana user-39=beauty user-40=darkstar user-41=eatspam user-42=boldover user-43=nove user-44=bakery user-45=crrtipdl user-46=sosevalu user-47=havantho user-48=cath
Sep 12 05:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=sketchy user-50=nvihkvu user-51=oubpgvbx user-52=tstardom user-53=what user-54=design user-55=stagingerris user-56=dancinggardener user-57=ladburyp user-58=kategilpin user-59=jennimil user-60=tomandle user-61=david user-62=nbhavers user-63=careers user-64=chrisdal user-65=mcdermos user-66=onlycont user-67=lucy user-68=attlebor user-69=romaldki user-70=outdoorc user-71=ranxterc user-72=hodgsonmail user-73=branko user-74=strathar user-75=atestord user-76=sarafoundation user-77=brmrjxl user-78=lakesan1 user-79=megacards user-80=musorguk user-81=wilsonsw user-82=dickemery123 user-83=ptkxhsbt user-84=martsblo user-85=magichat user-86=hhdugcor user-87=lbhyisi user-88=vantagep user-89=connect9 user-90=athenare user-91=lbscrmod user-92=maflemin user-93=booff user-94=markward user-95=foundation user-96=ulsukarm user-97=spectrum user-98=hodgesonweb user-99=theblack user-100=jarvisin user-101=stephani
Sep 12 05:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=leereyn1 user-103=agproduc user-104=still user-105=vivienn1 user-106=firstre2 user-107=oneoarco user-108=battlere user-109=nstriton user-110=brighto1 user-111=newstoda user-112=ggaaorgu user-113=belle user-114=bemadonn user-115=bedfords user-116=alexadmin user-117=skyfirec user-118=nativene user-119=innovat1 user-120=askhform user-121=stuartge user-122=coursemc user-123=opaiscyx user-124=ultbcrra user-125=jonhartl user-126=seftvta user-127=firstres user-128=firstred user-129=highlegh user-130=southlon user-131=firstrel user-132=clarkass user-133=costestimatorco user-134=putterfi user-135=hubmaster user-136=fetch user-137=carsinyo user-138=milloyco user-139=gilpin user-140=elecleis user-141=connectedshoppin user-142=thqkgnbz user-143=accooper user-144=ianrayne feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 12 05:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 05:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:09:59 nativespace-cdp sudo[910925]: pam_unix(sudo:session): session closed for user root
Sep 12 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:10:00 nativespace-cdp sudo[910930]: pam_unix(sudo:session): session closed for user root
Sep 12 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AAr64q3i4LcMiFLm.~
Sep 12 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:10:00 nativespace-cdp sudo[910934]: pam_unix(sudo:session): session closed for user root
Sep 12 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AAr64q3i4LcMiFLm.~'
Sep 12 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:10:00 nativespace-cdp sudo[910937]: pam_unix(sudo:session): session closed for user root
Sep 12 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AAr64q3i4LcMiFLm.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:10:00 nativespace-cdp sudo[910941]: pam_unix(sudo:session): session closed for user root
Sep 12 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:10:00 nativespace-cdp sudo[910944]: pam_unix(sudo:session): session closed for user root
Sep 12 05:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 05:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 05:10:01 nativespace-cdp sudo[910964]: pam_unix(sudo:session): session closed for user root
Sep 12 05:11:33 nativespace-cdp sshd[911391]: Connection closed by 159.100.136.21 port 37634 [preauth]
Sep 12 05:16:33 nativespace-cdp sshd[912592]: Connection closed by 159.100.136.21 port 46940 [preauth]
Sep 12 05:21:33 nativespace-cdp sshd[913822]: Connection closed by 159.100.136.21 port 55700 [preauth]
Sep 12 05:26:33 nativespace-cdp sshd[915139]: Connection closed by 159.100.136.21 port 37242 [preauth]
Sep 12 05:31:35 nativespace-cdp sshd[916261]: Connection closed by 159.100.136.21 port 46258 [preauth]
Sep 12 05:35:09 nativespace-cdp su: pam_unix(su:session): session opened for user connectedshoppin by (uid=0)
Sep 12 05:35:09 nativespace-cdp su[917001]: pam_unix(su:session): session closed for user connectedshoppin
Sep 12 05:36:33 nativespace-cdp sshd[917293]: Connection closed by 159.100.136.21 port 55992 [preauth]
Sep 12 05:41:34 nativespace-cdp sshd[918523]: Connection closed by 159.100.136.21 port 36898 [preauth]
Sep 12 05:45:19 nativespace-cdp sshd[919399]: Invalid user admin from 152.42.193.162 port 50852
Sep 12 05:45:19 nativespace-cdp sshd[919399]: input_userauth_request: invalid user admin [preauth]
Sep 12 05:45:19 nativespace-cdp sshd[919399]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 05:45:19 nativespace-cdp sshd[919399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.193.162
Sep 12 05:45:21 nativespace-cdp sshd[919399]: Failed password for invalid user admin from 152.42.193.162 port 50852 ssh2
Sep 12 05:45:21 nativespace-cdp sshd[919399]: Received disconnect from 152.42.193.162 port 50852:11: Bye Bye [preauth]
Sep 12 05:45:21 nativespace-cdp sshd[919399]: Disconnected from 152.42.193.162 port 50852 [preauth]
Sep 12 05:46:35 nativespace-cdp sshd[919940]: Connection closed by 159.100.136.21 port 44866 [preauth]
Sep 12 05:47:51 nativespace-cdp sshd[920128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.193.162  user=root
Sep 12 05:47:51 nativespace-cdp sshd[920128]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 05:47:53 nativespace-cdp sshd[920128]: Failed password for root from 152.42.193.162 port 35198 ssh2
Sep 12 05:47:53 nativespace-cdp sshd[920128]: Received disconnect from 152.42.193.162 port 35198:11: Bye Bye [preauth]
Sep 12 05:47:53 nativespace-cdp sshd[920128]: Disconnected from 152.42.193.162 port 35198 [preauth]
Sep 12 05:48:38 nativespace-cdp sshd[920351]: Invalid user ftp-test from 152.42.193.162 port 53588
Sep 12 05:48:38 nativespace-cdp sshd[920351]: input_userauth_request: invalid user ftp-test [preauth]
Sep 12 05:48:38 nativespace-cdp sshd[920351]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 05:48:38 nativespace-cdp sshd[920351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.193.162
Sep 12 05:48:40 nativespace-cdp sshd[920351]: Failed password for invalid user ftp-test from 152.42.193.162 port 53588 ssh2
Sep 12 05:48:41 nativespace-cdp sshd[920351]: Received disconnect from 152.42.193.162 port 53588:11: Bye Bye [preauth]
Sep 12 05:48:41 nativespace-cdp sshd[920351]: Disconnected from 152.42.193.162 port 53588 [preauth]
Sep 12 05:50:56 nativespace-cdp sshd[920945]: Invalid user lzh from 151.80.144.233 port 41210
Sep 12 05:50:56 nativespace-cdp sshd[920945]: input_userauth_request: invalid user lzh [preauth]
Sep 12 05:50:56 nativespace-cdp sshd[920945]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 05:50:56 nativespace-cdp sshd[920945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.144.233
Sep 12 05:50:58 nativespace-cdp sshd[920945]: Failed password for invalid user lzh from 151.80.144.233 port 41210 ssh2
Sep 12 05:50:58 nativespace-cdp sshd[920945]: Received disconnect from 151.80.144.233 port 41210:11: Bye Bye [preauth]
Sep 12 05:50:58 nativespace-cdp sshd[920945]: Disconnected from 151.80.144.233 port 41210 [preauth]
Sep 12 05:51:34 nativespace-cdp sshd[921054]: Connection closed by 159.100.136.21 port 54136 [preauth]
Sep 12 05:51:49 nativespace-cdp sshd[921109]: Invalid user sonarr from 151.80.144.233 port 54182
Sep 12 05:51:49 nativespace-cdp sshd[921109]: input_userauth_request: invalid user sonarr [preauth]
Sep 12 05:51:49 nativespace-cdp sshd[921109]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 05:51:49 nativespace-cdp sshd[921109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.144.233
Sep 12 05:51:52 nativespace-cdp sshd[921109]: Failed password for invalid user sonarr from 151.80.144.233 port 54182 ssh2
Sep 12 05:51:55 nativespace-cdp sshd[921109]: Received disconnect from 151.80.144.233 port 54182:11: Bye Bye [preauth]
Sep 12 05:51:55 nativespace-cdp sshd[921109]: Disconnected from 151.80.144.233 port 54182 [preauth]
Sep 12 05:52:24 nativespace-cdp sshd[921195]: Invalid user sipv from 151.80.144.233 port 53934
Sep 12 05:52:24 nativespace-cdp sshd[921195]: input_userauth_request: invalid user sipv [preauth]
Sep 12 05:52:24 nativespace-cdp sshd[921195]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 05:52:24 nativespace-cdp sshd[921195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.144.233
Sep 12 05:52:26 nativespace-cdp sshd[921195]: Failed password for invalid user sipv from 151.80.144.233 port 53934 ssh2
Sep 12 05:52:26 nativespace-cdp sshd[921195]: Received disconnect from 151.80.144.233 port 53934:11: Bye Bye [preauth]
Sep 12 05:52:26 nativespace-cdp sshd[921195]: Disconnected from 151.80.144.233 port 53934 [preauth]
Sep 12 05:56:35 nativespace-cdp sshd[922440]: Connection closed by 159.100.136.21 port 34592 [preauth]
Sep 12 06:01:33 nativespace-cdp sshd[923671]: Connection closed by 159.100.136.21 port 43592 [preauth]
Sep 12 06:06:33 nativespace-cdp sshd[924707]: Connection closed by 159.100.136.21 port 53160 [preauth]
Sep 12 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:50 nativespace-cdp sudo[925330]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:50 nativespace-cdp sudo[925333]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:50 nativespace-cdp sudo[925336]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:50 nativespace-cdp sudo[925340]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 06:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:53 nativespace-cdp sudo[925343]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:53 nativespace-cdp sudo[925354]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:53 nativespace-cdp sudo[925357]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:53 nativespace-cdp sudo[925360]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:53 nativespace-cdp sudo[925364]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:53 nativespace-cdp sudo[925367]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 06:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:53 nativespace-cdp sudo[925370]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:56 nativespace-cdp sudo[925382]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:56 nativespace-cdp sudo[925386]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=darkstar user-2=eatspam user-3=beauty user-4=dhyana user-5=fawcettd user-6=burydropin user-7=nsceres user-8=zebrapho user-9=bwppodcast user-10=steve user-11=asandcoc user-12=sibtoncc user-13=hirefootballgame user-14=courseme user-15=eugincou user-16=ninejimm user-17=reliable user-18=cathski user-19=cambria1 user-20=cwsocial user-21=pugwash user-22=paulmca1 user-23=howardon user-24=smrszyqg user-25=isleofwi user-26=tigerlet user-27=barbersh user-28=nomistakes user-29=hidden user-30=foods user-31=leftie user-32=fortunaz user-33=health2045 user-34=nscdp user-35=putterfc user-36=firstre5 user-37=steakbridieme user-38=donnychicago user-39=ctedorgu user-40=philmcph user-41=lkpier user-42=branko user-43=ranxterc user-44=hodgsonmail user-45=outdoorc user-46=romaldki user-47=lucy user-48=attlebor
Sep 12 06:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=mcdermos user-51=chrisdal user-52=david user-53=careers user-54=nbhavers user-55=tomandle user-56=jennimil user-57=kategilpin user-58=stagingerris user-59=dancinggardener user-60=ladburyp user-61=design user-62=what user-63=oubpgvbx user-64=tstardom user-65=nvihkvu user-66=havantho user-67=cath user-68=sketchy user-69=crrtipdl user-70=sosevalu user-71=bakery user-72=nove user-73=boldover user-74=agproduc user-75=still user-76=leereyn1 user-77=stephani user-78=jarvisin user-79=hodgesonweb user-80=theblack user-81=spectrum user-82=ulsukarm user-83=booff user-84=foundation user-85=markward user-86=lbscrmod user-87=maflemin user-88=vantagep user-89=athenare user-90=connect9 user-91=hhdugcor user-92=lbhyisi user-93=magichat user-94=martsblo user-95=ptkxhsbt user-96=dickemery123 user-97=wilsonsw user-98=megacards user-99=musorguk user-100=brmrjxl user-101=lakesan1 user-102=atestord
Sep 12 06:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=sarafoundation user-104=strathar user-105=ianrayne user-106=accooper user-107=thqkgnbz user-108=connectedshoppin user-109=elecleis user-110=gilpin user-111=milloyco user-112=fetch user-113=carsinyo user-114=putterfi user-115=hubmaster user-116=costestimatorco user-117=firstrel user-118=clarkass user-119=highlegh user-120=southlon user-121=firstred user-122=firstres user-123=ultbcrra user-124=jonhartl user-125=seftvta user-126=opaiscyx user-127=coursemc user-128=askhform user-129=stuartge user-130=innovat1 user-131=nativene user-132=skyfirec user-133=alexadmin user-134=bedfords user-135=bemadonn user-136=newstoda user-137=ggaaorgu user-138=belle user-139=nstriton user-140=brighto1 user-141=oneoarco user-142=battlere user-143=vivienn1 user-144=firstre2 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 06:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 06:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:57 nativespace-cdp sudo[925390]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:57 nativespace-cdp sudo[925395]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xdIcjshqWLLFi6nr.~
Sep 12 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:57 nativespace-cdp sudo[925398]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xdIcjshqWLLFi6nr.~'
Sep 12 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:57 nativespace-cdp sudo[925401]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-xdIcjshqWLLFi6nr.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:57 nativespace-cdp sudo[925405]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:57 nativespace-cdp sudo[925409]: pam_unix(sudo:session): session closed for user root
Sep 12 06:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 06:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 06:09:58 nativespace-cdp sudo[925427]: pam_unix(sudo:session): session closed for user root
Sep 12 06:11:33 nativespace-cdp sshd[925973]: Connection closed by 159.100.136.21 port 33794 [preauth]
Sep 12 06:16:33 nativespace-cdp sshd[927106]: Connection closed by 159.100.136.21 port 42888 [preauth]
Sep 12 06:21:33 nativespace-cdp sshd[928522]: Connection closed by 159.100.136.21 port 52180 [preauth]
Sep 12 06:26:33 nativespace-cdp sshd[929983]: Connection closed by 159.100.136.21 port 33514 [preauth]
Sep 12 06:31:33 nativespace-cdp sshd[931519]: Connection closed by 159.100.136.21 port 42728 [preauth]
Sep 12 06:36:33 nativespace-cdp sshd[932624]: Connection closed by 159.100.136.21 port 52270 [preauth]
Sep 12 06:41:33 nativespace-cdp sshd[934052]: Connection closed by 159.100.136.21 port 32822 [preauth]
Sep 12 06:46:34 nativespace-cdp sshd[935135]: Connection closed by 159.100.136.21 port 41858 [preauth]
Sep 12 06:50:58 nativespace-cdp sshd[936389]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.250.233.72  user=root
Sep 12 06:50:58 nativespace-cdp sshd[936389]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 06:51:00 nativespace-cdp sshd[936389]: Failed password for root from 46.250.233.72 port 39584 ssh2
Sep 12 06:51:00 nativespace-cdp sshd[936389]: Received disconnect from 46.250.233.72 port 39584:11: Bye Bye [preauth]
Sep 12 06:51:00 nativespace-cdp sshd[936389]: Disconnected from 46.250.233.72 port 39584 [preauth]
Sep 12 06:51:18 nativespace-cdp sshd[936496]: Invalid user adeo from 70.67.112.115 port 35074
Sep 12 06:51:18 nativespace-cdp sshd[936496]: input_userauth_request: invalid user adeo [preauth]
Sep 12 06:51:18 nativespace-cdp sshd[936496]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:51:18 nativespace-cdp sshd[936496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.67.112.115
Sep 12 06:51:20 nativespace-cdp sshd[936496]: Failed password for invalid user adeo from 70.67.112.115 port 35074 ssh2
Sep 12 06:51:20 nativespace-cdp sshd[936496]: Received disconnect from 70.67.112.115 port 35074:11: Bye Bye [preauth]
Sep 12 06:51:20 nativespace-cdp sshd[936496]: Disconnected from 70.67.112.115 port 35074 [preauth]
Sep 12 06:51:33 nativespace-cdp sshd[936575]: Connection closed by 159.100.136.21 port 51178 [preauth]
Sep 12 06:52:49 nativespace-cdp sshd[936821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.160.31  user=root
Sep 12 06:52:49 nativespace-cdp sshd[936821]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 06:52:51 nativespace-cdp sshd[936821]: Failed password for root from 14.63.160.31 port 34046 ssh2
Sep 12 06:52:51 nativespace-cdp sshd[936821]: Received disconnect from 14.63.160.31 port 34046:11: Bye Bye [preauth]
Sep 12 06:52:51 nativespace-cdp sshd[936821]: Disconnected from 14.63.160.31 port 34046 [preauth]
Sep 12 06:53:58 nativespace-cdp sshd[937141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.222.211.114  user=root
Sep 12 06:53:58 nativespace-cdp sshd[937141]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 06:54:00 nativespace-cdp sshd[937141]: Failed password for root from 61.222.211.114 port 49346 ssh2
Sep 12 06:54:01 nativespace-cdp sshd[937141]: Received disconnect from 61.222.211.114 port 49346:11: Bye Bye [preauth]
Sep 12 06:54:01 nativespace-cdp sshd[937141]: Disconnected from 61.222.211.114 port 49346 [preauth]
Sep 12 06:54:44 nativespace-cdp sshd[937302]: Invalid user sxt from 110.173.134.110 port 50970
Sep 12 06:54:44 nativespace-cdp sshd[937302]: input_userauth_request: invalid user sxt [preauth]
Sep 12 06:54:44 nativespace-cdp sshd[937302]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:54:44 nativespace-cdp sshd[937302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.173.134.110
Sep 12 06:54:46 nativespace-cdp sshd[937302]: Failed password for invalid user sxt from 110.173.134.110 port 50970 ssh2
Sep 12 06:54:46 nativespace-cdp sshd[937302]: Received disconnect from 110.173.134.110 port 50970:11: Bye Bye [preauth]
Sep 12 06:54:46 nativespace-cdp sshd[937302]: Disconnected from 110.173.134.110 port 50970 [preauth]
Sep 12 06:55:26 nativespace-cdp sshd[937492]: Invalid user user from 192.241.154.78 port 41974
Sep 12 06:55:26 nativespace-cdp sshd[937492]: input_userauth_request: invalid user user [preauth]
Sep 12 06:55:26 nativespace-cdp sshd[937492]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:55:26 nativespace-cdp sshd[937492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.154.78
Sep 12 06:55:27 nativespace-cdp sshd[937492]: Failed password for invalid user user from 192.241.154.78 port 41974 ssh2
Sep 12 06:55:27 nativespace-cdp sshd[937492]: Received disconnect from 192.241.154.78 port 41974:11: Bye Bye [preauth]
Sep 12 06:55:27 nativespace-cdp sshd[937492]: Disconnected from 192.241.154.78 port 41974 [preauth]
Sep 12 06:55:55 nativespace-cdp sshd[937589]: Invalid user iqbal from 70.67.112.115 port 45424
Sep 12 06:55:55 nativespace-cdp sshd[937589]: input_userauth_request: invalid user iqbal [preauth]
Sep 12 06:55:55 nativespace-cdp sshd[937589]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:55:55 nativespace-cdp sshd[937589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.67.112.115
Sep 12 06:55:58 nativespace-cdp sshd[937589]: Failed password for invalid user iqbal from 70.67.112.115 port 45424 ssh2
Sep 12 06:55:58 nativespace-cdp sshd[937589]: Received disconnect from 70.67.112.115 port 45424:11: Bye Bye [preauth]
Sep 12 06:55:58 nativespace-cdp sshd[937589]: Disconnected from 70.67.112.115 port 45424 [preauth]
Sep 12 06:56:13 nativespace-cdp sshd[937674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.160.31  user=root
Sep 12 06:56:13 nativespace-cdp sshd[937674]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 06:56:15 nativespace-cdp sshd[937674]: Failed password for root from 14.63.160.31 port 49124 ssh2
Sep 12 06:56:16 nativespace-cdp sshd[937674]: Received disconnect from 14.63.160.31 port 49124:11: Bye Bye [preauth]
Sep 12 06:56:16 nativespace-cdp sshd[937674]: Disconnected from 14.63.160.31 port 49124 [preauth]
Sep 12 06:56:26 nativespace-cdp sshd[937902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.222.211.114  user=root
Sep 12 06:56:26 nativespace-cdp sshd[937902]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 06:56:28 nativespace-cdp sshd[937902]: Failed password for root from 61.222.211.114 port 44946 ssh2
Sep 12 06:56:28 nativespace-cdp sshd[937902]: Received disconnect from 61.222.211.114 port 44946:11: Bye Bye [preauth]
Sep 12 06:56:28 nativespace-cdp sshd[937902]: Disconnected from 61.222.211.114 port 44946 [preauth]
Sep 12 06:56:36 nativespace-cdp sshd[938170]: Connection closed by 159.100.136.21 port 60148 [preauth]
Sep 12 06:56:37 nativespace-cdp sshd[938174]: Invalid user liuying from 70.67.112.115 port 58550
Sep 12 06:56:37 nativespace-cdp sshd[938174]: input_userauth_request: invalid user liuying [preauth]
Sep 12 06:56:37 nativespace-cdp sshd[938174]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:56:37 nativespace-cdp sshd[938174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.67.112.115
Sep 12 06:56:39 nativespace-cdp sshd[938174]: Failed password for invalid user liuying from 70.67.112.115 port 58550 ssh2
Sep 12 06:56:39 nativespace-cdp sshd[938174]: Received disconnect from 70.67.112.115 port 58550:11: Bye Bye [preauth]
Sep 12 06:56:39 nativespace-cdp sshd[938174]: Disconnected from 70.67.112.115 port 58550 [preauth]
Sep 12 06:56:48 nativespace-cdp sshd[938232]: Bad protocol version identification '\003' from 188.119.66.112 port 64271
Sep 12 06:56:48 nativespace-cdp sshd[938221]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.250.233.72  user=root
Sep 12 06:56:48 nativespace-cdp sshd[938221]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 06:56:50 nativespace-cdp sshd[938221]: Failed password for root from 46.250.233.72 port 39774 ssh2
Sep 12 06:56:50 nativespace-cdp sshd[938221]: Received disconnect from 46.250.233.72 port 39774:11: Bye Bye [preauth]
Sep 12 06:56:50 nativespace-cdp sshd[938221]: Disconnected from 46.250.233.72 port 39774 [preauth]
Sep 12 06:57:03 nativespace-cdp sshd[938257]: Connection closed by 14.63.160.31 port 56725 [preauth]
Sep 12 06:57:03 nativespace-cdp sshd[938278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.173.134.110  user=root
Sep 12 06:57:03 nativespace-cdp sshd[938278]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 06:57:05 nativespace-cdp sshd[938278]: Failed password for root from 110.173.134.110 port 59038 ssh2
Sep 12 06:57:05 nativespace-cdp sshd[938278]: Received disconnect from 110.173.134.110 port 59038:11: Bye Bye [preauth]
Sep 12 06:57:05 nativespace-cdp sshd[938278]: Disconnected from 110.173.134.110 port 59038 [preauth]
Sep 12 06:57:13 nativespace-cdp sshd[938301]: Invalid user kali from 61.222.211.114 port 56228
Sep 12 06:57:13 nativespace-cdp sshd[938301]: input_userauth_request: invalid user kali [preauth]
Sep 12 06:57:13 nativespace-cdp sshd[938301]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:57:13 nativespace-cdp sshd[938301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.222.211.114
Sep 12 06:57:15 nativespace-cdp sshd[938301]: Failed password for invalid user kali from 61.222.211.114 port 56228 ssh2
Sep 12 06:57:41 nativespace-cdp sshd[938408]: Invalid user gpr from 46.250.233.72 port 39850
Sep 12 06:57:41 nativespace-cdp sshd[938408]: input_userauth_request: invalid user gpr [preauth]
Sep 12 06:57:41 nativespace-cdp sshd[938408]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:57:41 nativespace-cdp sshd[938408]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.250.233.72
Sep 12 06:57:43 nativespace-cdp sshd[938408]: Failed password for invalid user gpr from 46.250.233.72 port 39850 ssh2
Sep 12 06:57:43 nativespace-cdp sshd[938408]: Received disconnect from 46.250.233.72 port 39850:11: Bye Bye [preauth]
Sep 12 06:57:43 nativespace-cdp sshd[938408]: Disconnected from 46.250.233.72 port 39850 [preauth]
Sep 12 06:57:52 nativespace-cdp sshd[938455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.160.31  user=root
Sep 12 06:57:52 nativespace-cdp sshd[938455]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 06:57:53 nativespace-cdp sshd[938455]: Failed password for root from 14.63.160.31 port 36094 ssh2
Sep 12 06:57:54 nativespace-cdp sshd[938455]: Received disconnect from 14.63.160.31 port 36094:11: Bye Bye [preauth]
Sep 12 06:57:54 nativespace-cdp sshd[938455]: Disconnected from 14.63.160.31 port 36094 [preauth]
Sep 12 06:58:01 nativespace-cdp sshd[938506]: Invalid user polycom from 110.173.134.110 port 54498
Sep 12 06:58:01 nativespace-cdp sshd[938506]: input_userauth_request: invalid user polycom [preauth]
Sep 12 06:58:01 nativespace-cdp sshd[938506]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:58:01 nativespace-cdp sshd[938506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.173.134.110
Sep 12 06:58:03 nativespace-cdp sshd[938506]: Failed password for invalid user polycom from 110.173.134.110 port 54498 ssh2
Sep 12 06:58:03 nativespace-cdp sshd[938506]: Received disconnect from 110.173.134.110 port 54498:11: Bye Bye [preauth]
Sep 12 06:58:03 nativespace-cdp sshd[938506]: Disconnected from 110.173.134.110 port 54498 [preauth]
Sep 12 06:59:00 nativespace-cdp sshd[938805]: Invalid user isis from 192.241.154.78 port 53040
Sep 12 06:59:00 nativespace-cdp sshd[938805]: input_userauth_request: invalid user isis [preauth]
Sep 12 06:59:00 nativespace-cdp sshd[938805]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:59:00 nativespace-cdp sshd[938805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.154.78
Sep 12 06:59:02 nativespace-cdp sshd[938805]: Failed password for invalid user isis from 192.241.154.78 port 53040 ssh2
Sep 12 06:59:02 nativespace-cdp sshd[938805]: Received disconnect from 192.241.154.78 port 53040:11: Bye Bye [preauth]
Sep 12 06:59:02 nativespace-cdp sshd[938805]: Disconnected from 192.241.154.78 port 53040 [preauth]
Sep 12 06:59:38 nativespace-cdp sshd[938910]: Invalid user contact from 192.241.154.78 port 54234
Sep 12 06:59:38 nativespace-cdp sshd[938910]: input_userauth_request: invalid user contact [preauth]
Sep 12 06:59:38 nativespace-cdp sshd[938910]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 06:59:38 nativespace-cdp sshd[938910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.154.78
Sep 12 06:59:40 nativespace-cdp sshd[938910]: Failed password for invalid user contact from 192.241.154.78 port 54234 ssh2
Sep 12 07:01:33 nativespace-cdp sshd[939517]: Connection closed by 159.100.136.21 port 41298 [preauth]
Sep 12 07:06:34 nativespace-cdp sshd[940652]: Connection closed by 159.100.136.21 port 50758 [preauth]
Sep 12 07:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 07:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:09:56 nativespace-cdp sudo[941575]: pam_unix(sudo:session): session closed for user root
Sep 12 07:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 07:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:09:56 nativespace-cdp sudo[941578]: pam_unix(sudo:session): session closed for user root
Sep 12 07:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 07:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:09:58 nativespace-cdp sudo[941581]: pam_unix(sudo:session): session closed for user root
Sep 12 07:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 07:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:09:58 nativespace-cdp sudo[941599]: pam_unix(sudo:session): session closed for user root
Sep 12 07:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 07:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:01 nativespace-cdp sudo[941602]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 07:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:01 nativespace-cdp sudo[941636]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 07:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:01 nativespace-cdp sudo[941693]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 07:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:01 nativespace-cdp sudo[941696]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 07:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:01 nativespace-cdp sudo[941699]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 07:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:02 nativespace-cdp sudo[941702]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 07:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:02 nativespace-cdp sudo[941716]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 07:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:15 nativespace-cdp sudo[941798]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 07:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:16 nativespace-cdp sudo[941804]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nove user-2=boldover user-3=bakery user-4=sosevalu user-5=crrtipdl user-6=oubpgvbx user-7=tstardom user-8=what user-9=sketchy user-10=cath user-11=havantho user-12=nvihkvu user-13=ladburyp user-14=dancinggardener user-15=stagingerris user-16=kategilpin user-17=design user-18=tomandle user-19=jennimil user-20=chrisdal user-21=mcdermos user-22=careers user-23=nbhavers user-24=david user-25=attlebor user-26=lucy user-27=onlycont user-28=hodgsonmail user-29=ranxterc user-30=outdoorc user-31=branko user-32=romaldki user-33=putterfc user-34=nscdp user-35=fortunaz user-36=health2045 user-37=foods user-38=leftie user-39=lkpier user-40=ctedorgu user-41=philmcph user-42=donnychicago user-43=steakbridieme user-44=firstre5 user-45=smrszyqg user-46=isleofwi user-47=hidden user-48=nomistakes user-49=tigerlet
Sep 12 07:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=barbersh user-51=cathski user-52=cambria1 user-53=reliable user-54=ninejimm user-55=howardon user-56=paulmca1 user-57=pugwash user-58=cwsocial user-59=hirefootballgame user-60=eugincou user-61=courseme user-62=asandcoc user-63=sibtoncc user-64=bwppodcast user-65=zebrapho user-66=steve user-67=burydropin user-68=fawcettd user-69=nsceres user-70=beauty user-71=eatspam user-72=darkstar user-73=dhyana user-74=brighto1 user-75=nstriton user-76=firstre2 user-77=vivienn1 user-78=battlere user-79=oneoarco user-80=bedfords user-81=ggaaorgu user-82=belle user-83=newstoda user-84=bemadonn user-85=alexadmin user-86=skyfirec user-87=innovat1 user-88=stuartge user-89=askhform user-90=nativene user-91=jonhartl user-92=seftvta user-93=ultbcrra user-94=firstres user-95=opaiscyx user-96=coursemc user-97=firstrel user-98=clarkass user-99=costestimatorco user-100=firstred user-101=southlon user-102=highlegh user-103=gilpin
Sep 12 07:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=milloyco user-105=elecleis user-106=putterfi user-107=hubmaster user-108=carsinyo user-109=fetch user-110=accooper user-111=ianrayne user-112=connectedshoppin user-113=thqkgnbz user-114=lakesan1 user-115=brmrjxl user-116=strathar user-117=sarafoundation user-118=atestord user-119=wilsonsw user-120=musorguk user-121=megacards user-122=martsblo user-123=dickemery123 user-124=ptkxhsbt user-125=lbhyisi user-126=hhdugcor user-127=magichat user-128=markward user-129=booff user-130=foundation user-131=connect9 user-132=athenare user-133=vantagep user-134=maflemin user-135=lbscrmod user-136=ulsukarm user-137=jarvisin user-138=spectrum user-139=theblack user-140=hodgesonweb user-141=still user-142=agproduc user-143=stephani user-144=leereyn1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains feature-9=webprotect
Sep 12 07:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 07:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:18 nativespace-cdp sudo[941811]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 07:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:18 nativespace-cdp sudo[941821]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3tcbDeKi1OGYw5yO.~
Sep 12 07:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:18 nativespace-cdp sudo[941824]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3tcbDeKi1OGYw5yO.~'
Sep 12 07:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:18 nativespace-cdp sudo[941827]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-3tcbDeKi1OGYw5yO.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 07:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:18 nativespace-cdp sudo[941831]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 07:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:18 nativespace-cdp sudo[941835]: pam_unix(sudo:session): session closed for user root
Sep 12 07:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 07:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 07:10:20 nativespace-cdp sudo[941854]: pam_unix(sudo:session): session closed for user root
Sep 12 07:11:33 nativespace-cdp sshd[942408]: Connection closed by 159.100.136.21 port 58992 [preauth]
Sep 12 07:16:33 nativespace-cdp sshd[943660]: Connection closed by 159.100.136.21 port 39688 [preauth]
Sep 12 07:21:34 nativespace-cdp sshd[944758]: Connection closed by 159.100.136.21 port 48462 [preauth]
Sep 12 07:26:33 nativespace-cdp sshd[946179]: Connection closed by 159.100.136.21 port 57686 [preauth]
Sep 12 07:31:33 nativespace-cdp sshd[947285]: Connection closed by 159.100.136.21 port 38746 [preauth]
Sep 12 07:36:33 nativespace-cdp sshd[948341]: Connection closed by 159.100.136.21 port 48420 [preauth]
Sep 12 07:41:36 nativespace-cdp sshd[949677]: Connection closed by 159.100.136.21 port 57864 [preauth]
Sep 12 07:46:33 nativespace-cdp sshd[950921]: Connection closed by 159.100.136.21 port 38676 [preauth]
Sep 12 07:51:33 nativespace-cdp sshd[951980]: Connection closed by 159.100.136.21 port 47484 [preauth]
Sep 12 07:56:36 nativespace-cdp sshd[953421]: Connection closed by 159.100.136.21 port 57052 [preauth]
Sep 12 08:01:33 nativespace-cdp sshd[954616]: Connection closed by 159.100.136.21 port 38160 [preauth]
Sep 12 08:06:37 nativespace-cdp sshd[955972]: Connection closed by 159.100.136.21 port 47968 [preauth]
Sep 12 08:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 08:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:52 nativespace-cdp sudo[956889]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 08:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:52 nativespace-cdp sudo[956892]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 08:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:53 nativespace-cdp sudo[956895]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 08:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:53 nativespace-cdp sudo[956901]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 08:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:56 nativespace-cdp sudo[956905]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 08:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:56 nativespace-cdp sudo[956914]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 08:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:56 nativespace-cdp sudo[956917]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 08:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:57 nativespace-cdp sudo[956921]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 08:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:57 nativespace-cdp sudo[956924]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 08:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:57 nativespace-cdp sudo[956927]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 08:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:57 nativespace-cdp sudo[956930]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:59 nativespace-cdp sudo[956948]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:09:59 nativespace-cdp sudo[956952]: pam_unix(sudo:session): session closed for user root
Sep 12 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=crrtipdl user-2=sosevalu user-3=bakery user-4=nove user-5=boldover user-6=kategilpin user-7=dancinggardener user-8=stagingerris user-9=ladburyp user-10=design user-11=what user-12=tstardom user-13=oubpgvbx user-14=nvihkvu user-15=havantho user-16=cath user-17=sketchy user-18=mcdermos user-19=chrisdal user-20=david user-21=careers user-22=nbhavers user-23=tomandle user-24=jennimil user-25=branko user-26=outdoorc user-27=ranxterc user-28=hodgsonmail user-29=romaldki user-30=lucy user-31=attlebor user-32=onlycont user-33=isleofwi user-34=smrszyqg user-35=tigerlet user-36=barbersh user-37=nomistakes user-38=hidden user-39=leftie user-40=foods user-41=health2045 user-42=fortunaz user-43=nscdp user-44=putterfc user-45=steakbridieme user-46=firstre5 user-47=donnychicago user-48=ctedorgu
Sep 12 08:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=philmcph user-50=lkpier user-51=hirefootballgame user-52=courseme user-53=eugincou user-54=reliable user-55=ninejimm user-56=cambria1 user-57=cathski user-58=cwsocial user-59=pugwash user-60=howardon user-61=paulmca1 user-62=zebrapho user-63=bwppodcast user-64=steve user-65=sibtoncc user-66=asandcoc user-67=darkstar user-68=eatspam user-69=beauty user-70=dhyana user-71=fawcettd user-72=burydropin user-73=nsceres user-74=bedfords user-75=bemadonn user-76=newstoda user-77=belle user-78=ggaaorgu user-79=nstriton user-80=brighto1 user-81=oneoarco user-82=battlere user-83=vivienn1 user-84=firstre2 user-85=stuartge user-86=askhform user-87=innovat1 user-88=nativene user-89=alexadmin user-90=skyfirec user-91=costestimatorco user-92=firstrel user-93=clarkass user-94=highlegh user-95=southlon user-96=firstred user-97=firstres user-98=ultbcrra user-99=jonhartl user-100=seftvta user-101=opaiscyx user-102=coursemc
Sep 12 08:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ianrayne user-104=accooper user-105=thqkgnbz user-106=connectedshoppin user-107=elecleis user-108=milloyco user-109=gilpin user-110=fetch user-111=carsinyo user-112=hubmaster user-113=putterfi user-114=wilsonsw user-115=megacards user-116=musorguk user-117=lakesan1 user-118=brmrjxl user-119=atestord user-120=sarafoundation user-121=strathar user-122=hhdugcor user-123=lbhyisi user-124=magichat user-125=martsblo user-126=ptkxhsbt user-127=dickemery123 user-128=ulsukarm user-129=booff user-130=markward user-131=foundation user-132=lbscrmod user-133=maflemin user-134=vantagep user-135=connect9 user-136=athenare user-137=agproduc user-138=still user-139=leereyn1 user-140=stephani user-141=jarvisin user-142=theblack user-143=hodgesonweb user-144=spectrum feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 08:09:59 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:10:00 nativespace-cdp sudo[956958]: pam_unix(sudo:session): session closed for user root
Sep 12 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:10:00 nativespace-cdp sudo[956964]: pam_unix(sudo:session): session closed for user root
Sep 12 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-koGbNBAqgQ2EBl2A.~
Sep 12 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:10:00 nativespace-cdp sudo[956967]: pam_unix(sudo:session): session closed for user root
Sep 12 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-koGbNBAqgQ2EBl2A.~'
Sep 12 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:10:00 nativespace-cdp sudo[956970]: pam_unix(sudo:session): session closed for user root
Sep 12 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-koGbNBAqgQ2EBl2A.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:10:00 nativespace-cdp sudo[956974]: pam_unix(sudo:session): session closed for user root
Sep 12 08:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 08:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:10:00 nativespace-cdp sudo[956977]: pam_unix(sudo:session): session closed for user root
Sep 12 08:10:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 08:10:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 08:10:24 nativespace-cdp sudo[957213]: pam_unix(sudo:session): session closed for user root
Sep 12 08:11:36 nativespace-cdp sshd[957568]: Connection closed by 159.100.136.21 port 57118 [preauth]
Sep 12 08:16:34 nativespace-cdp sshd[958786]: Connection closed by 159.100.136.21 port 38470 [preauth]
Sep 12 08:21:33 nativespace-cdp sshd[960062]: Connection closed by 159.100.136.21 port 46872 [preauth]
Sep 12 08:25:23 nativespace-cdp sshd[960891]: Did not receive identification string from 167.94.145.104 port 54916
Sep 12 08:25:49 nativespace-cdp sshd[960916]: Connection closed by 167.94.145.104 port 45968 [preauth]
Sep 12 08:26:33 nativespace-cdp sshd[961195]: Connection closed by 159.100.136.21 port 55922 [preauth]
Sep 12 08:31:33 nativespace-cdp sshd[962790]: Connection closed by 159.100.136.21 port 37080 [preauth]
Sep 12 08:36:33 nativespace-cdp sshd[964035]: Connection closed by 159.100.136.21 port 46194 [preauth]
Sep 12 08:41:33 nativespace-cdp sshd[965605]: Connection closed by 159.100.136.21 port 55150 [preauth]
Sep 12 08:46:33 nativespace-cdp sshd[966783]: Connection closed by 159.100.136.21 port 34256 [preauth]
Sep 12 08:51:36 nativespace-cdp sshd[967928]: Connection closed by 159.100.136.21 port 43296 [preauth]
Sep 12 08:56:33 nativespace-cdp sshd[969090]: Connection closed by 159.100.136.21 port 52898 [preauth]
Sep 12 09:01:33 nativespace-cdp sshd[970762]: Connection closed by 159.100.136.21 port 33540 [preauth]
Sep 12 09:06:33 nativespace-cdp sshd[972117]: Connection closed by 159.100.136.21 port 42264 [preauth]
Sep 12 09:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 09:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:09:58 nativespace-cdp sudo[972870]: pam_unix(sudo:session): session closed for user root
Sep 12 09:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 09:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:09:58 nativespace-cdp sudo[972874]: pam_unix(sudo:session): session closed for user root
Sep 12 09:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 09:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:00 nativespace-cdp sudo[972880]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 09:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:00 nativespace-cdp sudo[972893]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 09:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:21 nativespace-cdp sudo[972899]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 09:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:21 nativespace-cdp sudo[973100]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 09:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:21 nativespace-cdp sudo[973103]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 09:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:21 nativespace-cdp sudo[973106]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 09:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:21 nativespace-cdp sudo[973109]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 09:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:21 nativespace-cdp sudo[973113]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 09:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:21 nativespace-cdp sudo[973119]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 09:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:32 nativespace-cdp sudo[973146]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 09:10:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:34 nativespace-cdp sudo[973151]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=courseme user-2=eugincou user-3=hirefootballgame user-4=cwsocial user-5=paulmca1 user-6=pugwash user-7=howardon user-8=reliable user-9=ninejimm user-10=cathski user-11=cambria1 user-12=barbersh user-13=tigerlet user-14=nomistakes user-15=hidden user-16=smrszyqg user-17=isleofwi user-18=steakbridieme user-19=donnychicago user-20=firstre5 user-21=ctedorgu user-22=philmcph user-23=lkpier user-24=leftie user-25=foods user-26=fortunaz user-27=health2045 user-28=nscdp user-29=putterfc user-30=dhyana user-31=darkstar user-32=eatspam user-33=beauty user-34=nsceres user-35=fawcettd user-36=burydropin user-37=steve user-38=zebrapho user-39=bwppodcast user-40=sibtoncc user-41=asandcoc user-42=design user-43=kategilpin user-44=dancinggardener user-45=stagingerris user-46=ladburyp user-47=nvihkvu
Sep 12 09:10:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=havantho user-49=cath user-50=sketchy user-51=what user-52=tstardom user-53=oubpgvbx user-54=crrtipdl user-55=sosevalu user-56=bakery user-57=boldover user-58=nove user-59=romaldki user-60=branko user-61=hodgsonmail user-62=ranxterc user-63=outdoorc user-64=onlycont user-65=lucy user-66=attlebor user-67=david user-68=nbhavers user-69=careers user-70=mcdermos user-71=chrisdal user-72=jennimil user-73=tomandle user-74=magichat user-75=hhdugcor user-76=lbhyisi user-77=ptkxhsbt user-78=dickemery123 user-79=martsblo user-80=megacards user-81=musorguk user-82=wilsonsw user-83=atestord user-84=sarafoundation user-85=strathar user-86=lakesan1 user-87=brmrjxl user-88=leereyn1 user-89=stephani user-90=agproduc user-91=still user-92=hodgesonweb user-93=theblack user-94=spectrum user-95=jarvisin user-96=ulsukarm user-97=lbscrmod user-98=maflemin user-99=vantagep user-100=athenare user-101=connect9 user-102=markward
Sep 12 09:10:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=booff user-104=foundation user-105=nativene user-106=stuartge user-107=askhform user-108=innovat1 user-109=alexadmin user-110=skyfirec user-111=bemadonn user-112=newstoda user-113=belle user-114=ggaaorgu user-115=bedfords user-116=oneoarco user-117=battlere user-118=vivienn1 user-119=firstre2 user-120=nstriton user-121=brighto1 user-122=thqkgnbz user-123=connectedshoppin user-124=ianrayne user-125=accooper user-126=fetch user-127=carsinyo user-128=hubmaster user-129=putterfi user-130=elecleis user-131=milloyco user-132=gilpin user-133=highlegh user-134=southlon user-135=firstred user-136=costestimatorco user-137=clarkass user-138=firstrel user-139=coursemc user-140=opaiscyx user-141=firstres user-142=ultbcrra user-143=seftvta user-144=jonhartl feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 09:10:34 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 09:10:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:36 nativespace-cdp sudo[973158]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 09:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:37 nativespace-cdp sudo[973166]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UZrRMY7oTQ9oWnsp.~
Sep 12 09:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:37 nativespace-cdp sudo[973172]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UZrRMY7oTQ9oWnsp.~'
Sep 12 09:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:37 nativespace-cdp sudo[973175]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-UZrRMY7oTQ9oWnsp.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 09:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:37 nativespace-cdp sudo[973179]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 09:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:37 nativespace-cdp sudo[973182]: pam_unix(sudo:session): session closed for user root
Sep 12 09:10:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 09:10:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 09:10:55 nativespace-cdp sudo[973294]: pam_unix(sudo:session): session closed for user root
Sep 12 09:11:35 nativespace-cdp sshd[973438]: Connection closed by 159.100.136.21 port 51388 [preauth]
Sep 12 09:16:33 nativespace-cdp sshd[975028]: Connection closed by 159.100.136.21 port 60702 [preauth]
Sep 12 09:21:33 nativespace-cdp sshd[976237]: Connection closed by 159.100.136.21 port 41122 [preauth]
Sep 12 09:26:36 nativespace-cdp sshd[977482]: Connection closed by 159.100.136.21 port 50612 [preauth]
Sep 12 09:36:33 nativespace-cdp sshd[980770]: Connection closed by 159.100.136.21 port 41290 [preauth]
Sep 12 09:41:34 nativespace-cdp sshd[982207]: Connection closed by 159.100.136.21 port 50404 [preauth]
Sep 12 09:46:33 nativespace-cdp sshd[983771]: Connection closed by 159.100.136.21 port 60236 [preauth]
Sep 12 09:51:33 nativespace-cdp sshd[984977]: Connection closed by 159.100.136.21 port 41298 [preauth]
Sep 12 09:56:33 nativespace-cdp sshd[986316]: Connection closed by 159.100.136.21 port 51100 [preauth]
Sep 12 10:01:33 nativespace-cdp sshd[988067]: Connection closed by 159.100.136.21 port 59748 [preauth]
Sep 12 10:06:33 nativespace-cdp sshd[989529]: Connection closed by 159.100.136.21 port 39776 [preauth]
Sep 12 10:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 10:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:09:57 nativespace-cdp sudo[990324]: pam_unix(sudo:session): session closed for user root
Sep 12 10:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 10:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:09:57 nativespace-cdp sudo[990328]: pam_unix(sudo:session): session closed for user root
Sep 12 10:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 10:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:09:58 nativespace-cdp sudo[990333]: pam_unix(sudo:session): session closed for user root
Sep 12 10:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 10:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:09:58 nativespace-cdp sudo[990341]: pam_unix(sudo:session): session closed for user root
Sep 12 10:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 10:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:05 nativespace-cdp sudo[990347]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 10:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:05 nativespace-cdp sudo[990580]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 10:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:05 nativespace-cdp sudo[990584]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 10:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:05 nativespace-cdp sudo[990587]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 10:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:05 nativespace-cdp sudo[990590]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 10:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:05 nativespace-cdp sudo[990593]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 10:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:06 nativespace-cdp sudo[990596]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 10:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:15 nativespace-cdp sudo[990626]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 10:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:16 nativespace-cdp sudo[990631]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=accooper user-2=ianrayne user-3=connectedshoppin user-4=thqkgnbz user-5=gilpin user-6=milloyco user-7=elecleis user-8=hubmaster user-9=putterfi user-10=fetch user-11=carsinyo user-12=firstrel user-13=clarkass user-14=costestimatorco user-15=firstred user-16=highlegh user-17=southlon user-18=ultbcrra user-19=jonhartl user-20=seftvta user-21=firstres user-22=coursemc user-23=opaiscyx user-24=innovat1 user-25=askhform user-26=stuartge user-27=nativene user-28=alexadmin user-29=skyfirec user-30=bedfords user-31=newstoda user-32=ggaaorgu user-33=belle user-34=bemadonn user-35=nstriton user-36=brighto1 user-37=vivienn1 user-38=firstre2 user-39=oneoarco user-40=battlere user-41=agproduc user-42=still user-43=stephani user-44=leereyn1 user-45=jarvisin user-46=spectrum user-47=hodgesonweb
Sep 12 10:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=theblack user-49=ulsukarm user-50=booff user-51=foundation user-52=markward user-53=vantagep user-54=athenare user-55=connect9 user-56=lbscrmod user-57=maflemin user-58=hhdugcor user-59=lbhyisi user-60=magichat user-61=martsblo user-62=dickemery123 user-63=ptkxhsbt user-64=wilsonsw user-65=megacards user-66=musorguk user-67=brmrjxl user-68=lakesan1 user-69=strathar user-70=atestord user-71=sarafoundation user-72=outdoorc user-73=ranxterc user-74=hodgsonmail user-75=branko user-76=romaldki user-77=lucy user-78=attlebor user-79=onlycont user-80=chrisdal user-81=mcdermos user-82=david user-83=nbhavers user-84=careers user-85=tomandle user-86=jennimil user-87=stagingerris user-88=dancinggardener user-89=ladburyp user-90=kategilpin user-91=design user-92=tstardom user-93=oubpgvbx user-94=what user-95=havantho user-96=cath user-97=sketchy user-98=nvihkvu user-99=bakery user-100=crrtipdl user-101=sosevalu
Sep 12 10:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=nove user-103=boldover user-104=beauty user-105=darkstar user-106=eatspam user-107=dhyana user-108=fawcettd user-109=burydropin user-110=nsceres user-111=bwppodcast user-112=zebrapho user-113=steve user-114=asandcoc user-115=sibtoncc user-116=hirefootballgame user-117=eugincou user-118=courseme user-119=cambria1 user-120=cathski user-121=ninejimm user-122=reliable user-123=cwsocial user-124=pugwash user-125=howardon user-126=paulmca1 user-127=isleofwi user-128=smrszyqg user-129=nomistakes user-130=hidden user-131=tigerlet user-132=barbersh user-133=nscdp user-134=putterfc user-135=foods user-136=leftie user-137=health2045 user-138=fortunaz user-139=lkpier user-140=steakbridieme user-141=donnychicago user-142=firstre5 user-143=ctedorgu user-144=philmcph feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 10:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 10:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:17 nativespace-cdp sudo[990638]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 10:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:18 nativespace-cdp sudo[990651]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wzlWMUplLizJ3Mea.~
Sep 12 10:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:18 nativespace-cdp sudo[990654]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wzlWMUplLizJ3Mea.~'
Sep 12 10:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:18 nativespace-cdp sudo[990657]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-wzlWMUplLizJ3Mea.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 10:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:18 nativespace-cdp sudo[990661]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 10:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:18 nativespace-cdp sudo[990664]: pam_unix(sudo:session): session closed for user root
Sep 12 10:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 10:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 10:10:25 nativespace-cdp sudo[990692]: pam_unix(sudo:session): session closed for user root
Sep 12 10:11:34 nativespace-cdp sshd[991389]: Connection closed by 159.100.136.21 port 47362 [preauth]
Sep 12 10:16:33 nativespace-cdp sshd[992670]: Connection closed by 159.100.136.21 port 56690 [preauth]
Sep 12 10:21:37 nativespace-cdp sshd[993963]: Connection closed by 159.100.136.21 port 37264 [preauth]
Sep 12 10:26:35 nativespace-cdp sshd[995154]: Connection closed by 159.100.136.21 port 45784 [preauth]
Sep 12 10:31:34 nativespace-cdp sshd[996870]: Connection closed by 159.100.136.21 port 54446 [preauth]
Sep 12 10:36:33 nativespace-cdp sshd[998114]: Connection closed by 159.100.136.21 port 35356 [preauth]
Sep 12 10:41:33 nativespace-cdp sshd[999539]: Connection closed by 159.100.136.21 port 43402 [preauth]
Sep 12 10:46:35 nativespace-cdp sshd[1001005]: Connection closed by 159.100.136.21 port 52828 [preauth]
Sep 12 10:51:33 nativespace-cdp sshd[1002515]: Connection closed by 159.100.136.21 port 33850 [preauth]
Sep 12 10:56:34 nativespace-cdp sshd[1004121]: Connection closed by 159.100.136.21 port 42710 [preauth]
Sep 12 11:01:33 nativespace-cdp sshd[1005762]: Connection closed by 159.100.136.21 port 51506 [preauth]
Sep 12 11:06:33 nativespace-cdp sshd[1007158]: Connection closed by 159.100.136.21 port 32910 [preauth]
Sep 12 11:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 11:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:16 nativespace-cdp sudo[1007934]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 11:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:16 nativespace-cdp sudo[1007939]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 11:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:19 nativespace-cdp sudo[1007942]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 11:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:19 nativespace-cdp sudo[1007955]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 11:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:34 nativespace-cdp sudo[1007959]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:35 nativespace-cdp sudo[1008014]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:35 nativespace-cdp sudo[1008017]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:35 nativespace-cdp sudo[1008020]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:35 nativespace-cdp sudo[1008023]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:35 nativespace-cdp sudo[1008026]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 11:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:35 nativespace-cdp sudo[1008029]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 11:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:44 nativespace-cdp sudo[1008065]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 11:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:45 nativespace-cdp sudo[1008070]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=vantagep user-2=connect9 user-3=athenare user-4=lbscrmod user-5=maflemin user-6=booff user-7=foundation user-8=markward user-9=ulsukarm user-10=spectrum user-11=hodgesonweb user-12=theblack user-13=jarvisin user-14=stephani user-15=leereyn1 user-16=agproduc user-17=still user-18=strathar user-19=atestord user-20=sarafoundation user-21=brmrjxl user-22=lakesan1 user-23=megacards user-24=musorguk user-25=wilsonsw user-26=dickemery123 user-27=ptkxhsbt user-28=martsblo user-29=magichat user-30=hhdugcor user-31=lbhyisi user-32=opaiscyx user-33=coursemc user-34=ultbcrra user-35=seftvta user-36=jonhartl user-37=firstres user-38=firstred user-39=highlegh user-40=southlon user-41=clarkass user-42=firstrel user-43=costestimatorco user-44=hubmaster user-45=putterfi user-46=fetch user-47=carsinyo
Sep 12 11:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=gilpin user-49=milloyco user-50=elecleis user-51=connectedshoppin user-52=thqkgnbz user-53=accooper user-54=ianrayne user-55=vivienn1 user-56=firstre2 user-57=oneoarco user-58=battlere user-59=nstriton user-60=brighto1 user-61=newstoda user-62=belle user-63=ggaaorgu user-64=bemadonn user-65=bedfords user-66=skyfirec user-67=alexadmin user-68=nativene user-69=innovat1 user-70=askhform user-71=stuartge user-72=asandcoc user-73=sibtoncc user-74=steve user-75=bwppodcast user-76=zebrapho user-77=nsceres user-78=fawcettd user-79=burydropin user-80=dhyana user-81=beauty user-82=darkstar user-83=eatspam user-84=lkpier user-85=steakbridieme user-86=firstre5 user-87=donnychicago user-88=ctedorgu user-89=philmcph user-90=nscdp user-91=putterfc user-92=foods user-93=leftie user-94=health2045 user-95=fortunaz user-96=nomistakes user-97=hidden user-98=barbersh user-99=tigerlet user-100=isleofwi user-101=smrszyqg
Sep 12 11:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=cwsocial user-103=pugwash user-104=paulmca1 user-105=howardon user-106=cambria1 user-107=cathski user-108=reliable user-109=ninejimm user-110=eugincou user-111=courseme user-112=hirefootballgame user-113=jennimil user-114=tomandle user-115=david user-116=careers user-117=nbhavers user-118=chrisdal user-119=mcdermos user-120=onlycont user-121=lucy user-122=attlebor user-123=romaldki user-124=outdoorc user-125=ranxterc user-126=hodgsonmail user-127=branko user-128=boldover user-129=nove user-130=bakery user-131=crrtipdl user-132=sosevalu user-133=havantho user-134=cath user-135=sketchy user-136=nvihkvu user-137=oubpgvbx user-138=tstardom user-139=what user-140=design user-141=stagingerris user-142=dancinggardener user-143=ladburyp user-144=kategilpin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 11:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 11:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:46 nativespace-cdp sudo[1008079]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 12 11:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:48 nativespace-cdp sudo[1008095]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep 12 11:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 12 11:09:48 nativespace-cdp sudo[1008104]: pam_unix(sudo:session): session closed for user onlycont
Sep 12 11:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 11:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:49 nativespace-cdp sudo[1008120]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 12 11:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 11:09:49 nativespace-cdp sudo[1008126]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 11:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 12 11:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:52 nativespace-cdp sudo[1008148]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep 12 11:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 12 11:09:52 nativespace-cdp sudo[1008164]: pam_unix(sudo:session): session closed for user lkpier
Sep 12 11:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 12 11:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:53 nativespace-cdp sudo[1008179]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep 12 11:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 12 11:09:53 nativespace-cdp sudo[1008191]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 12 11:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 12 11:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 12 11:09:53 nativespace-cdp sudo[1008205]: pam_unix(sudo:session): session closed for user oneoarco
Sep 12 11:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 12 11:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:54 nativespace-cdp sudo[1008217]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep 12 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 12 11:09:54 nativespace-cdp sudo[1008222]: pam_unix(sudo:session): session closed for user fortunaz
Sep 12 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep 12 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:54 nativespace-cdp sudo[1008236]: pam_unix(sudo:session): session closed for user root
Sep 12 11:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 11:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:09:54 nativespace-cdp sudo[1008241]: pam_unix(sudo:session): session closed for user root
Sep 12 11:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep 12 11:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:10:17 nativespace-cdp sudo[1009377]: pam_unix(sudo:session): session closed for user root
Sep 12 11:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep 12 11:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:10:17 nativespace-cdp sudo[1009382]: pam_unix(sudo:session): session closed for user root
Sep 12 11:10:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 11:10:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:10:18 nativespace-cdp sudo[1009393]: pam_unix(sudo:session): session closed for user root
Sep 12 11:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-JbTGSF0QlTDzRaut.~
Sep 12 11:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:10:19 nativespace-cdp sudo[1009400]: pam_unix(sudo:session): session closed for user root
Sep 12 11:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-JbTGSF0QlTDzRaut.~'
Sep 12 11:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:10:19 nativespace-cdp sudo[1009404]: pam_unix(sudo:session): session closed for user root
Sep 12 11:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-JbTGSF0QlTDzRaut.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 11:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:10:19 nativespace-cdp sudo[1009410]: pam_unix(sudo:session): session closed for user root
Sep 12 11:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 11:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:10:19 nativespace-cdp sudo[1009415]: pam_unix(sudo:session): session closed for user root
Sep 12 11:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 11:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 11:10:21 nativespace-cdp sudo[1009431]: pam_unix(sudo:session): session closed for user root
Sep 12 11:11:33 nativespace-cdp sshd[1010150]: Connection closed by 159.100.136.21 port 42074 [preauth]
Sep 12 11:16:34 nativespace-cdp sshd[1011517]: Connection closed by 159.100.136.21 port 51884 [preauth]
Sep 12 11:21:33 nativespace-cdp sshd[1012947]: Connection closed by 159.100.136.21 port 33084 [preauth]
Sep 12 11:24:47 nativespace-cdp sshd[1013494]: Invalid user kamil from 177.157.203.16 port 38422
Sep 12 11:24:47 nativespace-cdp sshd[1013494]: input_userauth_request: invalid user kamil [preauth]
Sep 12 11:24:47 nativespace-cdp sshd[1013494]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 11:24:47 nativespace-cdp sshd[1013494]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.157.203.16
Sep 12 11:24:49 nativespace-cdp sshd[1013494]: Failed password for invalid user kamil from 177.157.203.16 port 38422 ssh2
Sep 12 11:24:49 nativespace-cdp sshd[1013494]: Received disconnect from 177.157.203.16 port 38422:11: Bye Bye [preauth]
Sep 12 11:24:49 nativespace-cdp sshd[1013494]: Disconnected from 177.157.203.16 port 38422 [preauth]
Sep 12 11:25:23 nativespace-cdp sshd[1013734]: Invalid user localhost from 159.89.168.110 port 55018
Sep 12 11:25:23 nativespace-cdp sshd[1013734]: input_userauth_request: invalid user localhost [preauth]
Sep 12 11:25:23 nativespace-cdp sshd[1013734]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 11:25:23 nativespace-cdp sshd[1013734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.168.110
Sep 12 11:25:24 nativespace-cdp sshd[1013734]: Failed password for invalid user localhost from 159.89.168.110 port 55018 ssh2
Sep 12 11:25:24 nativespace-cdp sshd[1013734]: Received disconnect from 159.89.168.110 port 55018:11: Bye Bye [preauth]
Sep 12 11:25:24 nativespace-cdp sshd[1013734]: Disconnected from 159.89.168.110 port 55018 [preauth]
Sep 12 11:25:41 nativespace-cdp sshd[1013996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.157.203.16  user=root
Sep 12 11:25:41 nativespace-cdp sshd[1013996]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 11:25:43 nativespace-cdp sshd[1013996]: Failed password for root from 177.157.203.16 port 47478 ssh2
Sep 12 11:25:43 nativespace-cdp sshd[1013996]: Received disconnect from 177.157.203.16 port 47478:11: Bye Bye [preauth]
Sep 12 11:25:43 nativespace-cdp sshd[1013996]: Disconnected from 177.157.203.16 port 47478 [preauth]
Sep 12 11:26:14 nativespace-cdp sshd[1014113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.232.136.32  user=root
Sep 12 11:26:14 nativespace-cdp sshd[1014113]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 11:26:17 nativespace-cdp sshd[1014113]: Failed password for root from 165.232.136.32 port 53006 ssh2
Sep 12 11:26:17 nativespace-cdp sshd[1014113]: Received disconnect from 165.232.136.32 port 53006:11: Bye Bye [preauth]
Sep 12 11:26:17 nativespace-cdp sshd[1014113]: Disconnected from 165.232.136.32 port 53006 [preauth]
Sep 12 11:26:18 nativespace-cdp sshd[1014147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.157.203.16  user=root
Sep 12 11:26:18 nativespace-cdp sshd[1014147]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 11:26:20 nativespace-cdp sshd[1014147]: Failed password for root from 177.157.203.16 port 53742 ssh2
Sep 12 11:26:33 nativespace-cdp sshd[1014287]: Connection closed by 159.100.136.21 port 42840 [preauth]
Sep 12 11:29:35 nativespace-cdp sshd[1015111]: Invalid user deployer from 159.89.168.110 port 35052
Sep 12 11:29:35 nativespace-cdp sshd[1015111]: input_userauth_request: invalid user deployer [preauth]
Sep 12 11:29:35 nativespace-cdp sshd[1015111]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 11:29:35 nativespace-cdp sshd[1015111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.168.110
Sep 12 11:29:37 nativespace-cdp sshd[1015111]: Failed password for invalid user deployer from 159.89.168.110 port 35052 ssh2
Sep 12 11:29:37 nativespace-cdp sshd[1015111]: Received disconnect from 159.89.168.110 port 35052:11: Bye Bye [preauth]
Sep 12 11:29:37 nativespace-cdp sshd[1015111]: Disconnected from 159.89.168.110 port 35052 [preauth]
Sep 12 11:30:13 nativespace-cdp sshd[1015415]: Invalid user pls from 165.232.136.32 port 48986
Sep 12 11:30:13 nativespace-cdp sshd[1015415]: input_userauth_request: invalid user pls [preauth]
Sep 12 11:30:13 nativespace-cdp sshd[1015415]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 11:30:13 nativespace-cdp sshd[1015415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.232.136.32
Sep 12 11:30:15 nativespace-cdp sshd[1015415]: Failed password for invalid user pls from 165.232.136.32 port 48986 ssh2
Sep 12 11:30:18 nativespace-cdp sshd[1015415]: Received disconnect from 165.232.136.32 port 48986:11: Bye Bye [preauth]
Sep 12 11:30:18 nativespace-cdp sshd[1015415]: Disconnected from 165.232.136.32 port 48986 [preauth]
Sep 12 11:30:20 nativespace-cdp sshd[1015440]: Invalid user smart from 159.89.168.110 port 59128
Sep 12 11:30:20 nativespace-cdp sshd[1015440]: input_userauth_request: invalid user smart [preauth]
Sep 12 11:30:20 nativespace-cdp sshd[1015440]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 11:30:20 nativespace-cdp sshd[1015440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.168.110
Sep 12 11:30:22 nativespace-cdp sshd[1015440]: Failed password for invalid user smart from 159.89.168.110 port 59128 ssh2
Sep 12 11:30:22 nativespace-cdp sshd[1015440]: Received disconnect from 159.89.168.110 port 59128:11: Bye Bye [preauth]
Sep 12 11:30:22 nativespace-cdp sshd[1015440]: Disconnected from 159.89.168.110 port 59128 [preauth]
Sep 12 11:30:51 nativespace-cdp sshd[1015665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.232.136.32  user=root
Sep 12 11:30:51 nativespace-cdp sshd[1015665]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 11:30:53 nativespace-cdp sshd[1015665]: Failed password for root from 165.232.136.32 port 37196 ssh2
Sep 12 11:31:33 nativespace-cdp sshd[1015923]: Connection closed by 159.100.136.21 port 50942 [preauth]
Sep 12 11:36:33 nativespace-cdp sshd[1017227]: Connection closed by 159.100.136.21 port 60422 [preauth]
Sep 12 11:41:35 nativespace-cdp sshd[1018882]: Connection closed by 159.100.136.21 port 40988 [preauth]
Sep 12 11:46:33 nativespace-cdp sshd[1020330]: Connection closed by 159.100.136.21 port 50300 [preauth]
Sep 12 11:51:33 nativespace-cdp sshd[1021639]: Connection closed by 159.100.136.21 port 59440 [preauth]
Sep 12 11:56:33 nativespace-cdp sshd[1023146]: Connection closed by 159.100.136.21 port 40548 [preauth]
Sep 12 12:01:38 nativespace-cdp sshd[1024719]: Connection closed by 159.100.136.21 port 49706 [preauth]
Sep 12 12:06:33 nativespace-cdp sshd[1026045]: Connection closed by 159.100.136.21 port 58740 [preauth]
Sep 12 12:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 12:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:11 nativespace-cdp sudo[1026704]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 12:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:11 nativespace-cdp sudo[1026708]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 12:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:14 nativespace-cdp sudo[1026714]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 12:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:14 nativespace-cdp sudo[1026730]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 12:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:16 nativespace-cdp sudo[1026737]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 12:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:16 nativespace-cdp sudo[1026749]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 12:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:16 nativespace-cdp sudo[1026755]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 12:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:16 nativespace-cdp sudo[1026759]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 12:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:16 nativespace-cdp sudo[1026764]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 12:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:16 nativespace-cdp sudo[1026770]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 12:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:16 nativespace-cdp sudo[1026776]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 12:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:33 nativespace-cdp sudo[1026821]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 12:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:33 nativespace-cdp sudo[1026828]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=dhyana user-2=beauty user-3=eatspam user-4=darkstar user-5=nsceres user-6=burydropin user-7=fawcettd user-8=steve user-9=bwppodcast user-10=zebrapho user-11=asandcoc user-12=sibtoncc user-13=eugincou user-14=courseme user-15=hirefootballgame user-16=paulmca1 user-17=howardon user-18=pugwash user-19=cwsocial user-20=cambria1 user-21=cathski user-22=reliable user-23=ninejimm user-24=hidden user-25=nomistakes user-26=tigerlet user-27=barbersh user-28=smrszyqg user-29=isleofwi user-30=lkpier user-31=ctedorgu user-32=philmcph user-33=donnychicago user-34=steakbridieme user-35=firstre5 user-36=putterfc user-37=nscdp user-38=health2045 user-39=fortunaz user-40=foods user-41=leftie user-42=romaldki user-43=hodgsonmail user-44=ranxterc user-45=outdoorc user-46=branko user-47=onlycont user-48=attlebor
Sep 12 12:09:33 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=lucy user-50=nbhavers user-51=careers user-52=david user-53=chrisdal user-54=mcdermos user-55=jennimil user-56=tomandle user-57=design user-58=ladburyp user-59=stagingerris user-60=dancinggardener user-61=kategilpin user-62=cath user-63=sketchy user-64=havantho user-65=nvihkvu user-66=oubpgvbx user-67=tstardom user-68=what user-69=bakery user-70=sosevalu user-71=crrtipdl user-72=boldover user-73=nove user-74=stephani user-75=leereyn1 user-76=still user-77=agproduc user-78=spectrum user-79=theblack user-80=hodgesonweb user-81=jarvisin user-82=ulsukarm user-83=athenare user-84=connect9 user-85=vantagep user-86=maflemin user-87=lbscrmod user-88=booff user-89=markward user-90=foundation user-91=magichat user-92=lbhyisi user-93=hhdugcor user-94=dickemery123 user-95=ptkxhsbt user-96=martsblo user-97=musorguk user-98=megacards user-99=wilsonsw user-100=strathar user-101=sarafoundation user-102=atestord
Sep 12 12:09:33 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=lakesan1 user-104=brmrjxl user-105=connectedshoppin user-106=thqkgnbz user-107=accooper user-108=ianrayne user-109=hubmaster user-110=putterfi user-111=carsinyo user-112=fetch user-113=milloyco user-114=gilpin user-115=elecleis user-116=firstred user-117=southlon user-118=highlegh user-119=clarkass user-120=firstrel user-121=costestimatorco user-122=coursemc user-123=opaiscyx user-124=seftvta user-125=jonhartl user-126=ultbcrra user-127=firstres user-128=nativene user-129=innovat1 user-130=stuartge user-131=askhform user-132=skyfirec user-133=alexadmin user-134=ggaaorgu user-135=belle user-136=newstoda user-137=bemadonn user-138=bedfords user-139=firstre2 user-140=vivienn1 user-141=battlere user-142=oneoarco user-143=brighto1 user-144=nstriton feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 12:09:33 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 12:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:34 nativespace-cdp sudo[1026835]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 12:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:34 nativespace-cdp sudo[1026846]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nGwP29eye0jfYScb.~
Sep 12 12:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:34 nativespace-cdp sudo[1026853]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nGwP29eye0jfYScb.~'
Sep 12 12:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:34 nativespace-cdp sudo[1026857]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nGwP29eye0jfYScb.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 12:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:34 nativespace-cdp sudo[1026863]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 12:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:34 nativespace-cdp sudo[1026868]: pam_unix(sudo:session): session closed for user root
Sep 12 12:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 12:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 12:09:51 nativespace-cdp sudo[1026934]: pam_unix(sudo:session): session closed for user root
Sep 12 12:11:33 nativespace-cdp sshd[1027732]: Connection closed by 159.100.136.21 port 38836 [preauth]
Sep 12 12:16:35 nativespace-cdp sshd[1029123]: Connection closed by 159.100.136.21 port 48482 [preauth]
Sep 12 12:21:33 nativespace-cdp sshd[1030284]: Connection closed by 159.100.136.21 port 57456 [preauth]
Sep 12 12:26:34 nativespace-cdp sshd[1031679]: Connection closed by 159.100.136.21 port 38926 [preauth]
Sep 12 12:36:33 nativespace-cdp sshd[1034611]: Connection closed by 159.100.136.21 port 55316 [preauth]
Sep 12 12:41:33 nativespace-cdp sshd[1036141]: Connection closed by 159.100.136.21 port 37100 [preauth]
Sep 12 12:46:33 nativespace-cdp sshd[1037533]: Connection closed by 159.100.136.21 port 47354 [preauth]
Sep 12 12:51:33 nativespace-cdp sshd[1039091]: Connection closed by 159.100.136.21 port 57338 [preauth]
Sep 12 12:56:33 nativespace-cdp sshd[1041310]: Connection closed by 159.100.136.21 port 39396 [preauth]
Sep 12 13:01:34 nativespace-cdp sshd[1043130]: Connection closed by 159.100.136.21 port 49414 [preauth]
Sep 12 13:06:33 nativespace-cdp sshd[1044571]: Connection closed by 159.100.136.21 port 59734 [preauth]
Sep 12 13:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 13:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:27 nativespace-cdp sudo[1045150]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 13:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:27 nativespace-cdp sudo[1045155]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 13:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:28 nativespace-cdp sudo[1045160]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 13:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:28 nativespace-cdp sudo[1045228]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 13:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:33 nativespace-cdp sudo[1045234]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 13:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:33 nativespace-cdp sudo[1045254]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 13:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:33 nativespace-cdp sudo[1045259]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 13:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:33 nativespace-cdp sudo[1045263]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 13:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:33 nativespace-cdp sudo[1045269]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 13:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:33 nativespace-cdp sudo[1045275]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 13:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:33 nativespace-cdp sudo[1045280]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 13:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:35 nativespace-cdp sudo[1045293]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 13:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:37 nativespace-cdp sudo[1045301]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=oubpgvbx user-2=tstardom user-3=what user-4=cath user-5=sketchy user-6=havantho user-7=nvihkvu user-8=ladburyp user-9=dancinggardener user-10=stagingerris user-11=kategilpin user-12=design user-13=nove user-14=boldover user-15=bakery user-16=sosevalu user-17=crrtipdl user-18=attlebor user-19=lucy user-20=onlycont user-21=ranxterc user-22=hodgsonmail user-23=outdoorc user-24=branko user-25=romaldki user-26=tomandle user-27=jennimil user-28=chrisdal user-29=mcdermos user-30=nbhavers user-31=careers user-32=david user-33=cambria1 user-34=cathski user-35=ninejimm user-36=reliable user-37=paulmca1 user-38=howardon user-39=pugwash user-40=cwsocial user-41=hirefootballgame user-42=eugincou user-43=courseme user-44=putterfc user-45=nscdp user-46=fortunaz user-47=health2045 user-48=foods user-49=leftie
Sep 12 13:09:37 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=lkpier user-51=ctedorgu user-52=philmcph user-53=donnychicago user-54=steakbridieme user-55=firstre5 user-56=smrszyqg user-57=isleofwi user-58=hidden user-59=nomistakes user-60=tigerlet user-61=barbersh user-62=burydropin user-63=fawcettd user-64=nsceres user-65=beauty user-66=eatspam user-67=darkstar user-68=dhyana user-69=asandcoc user-70=sibtoncc user-71=bwppodcast user-72=zebrapho user-73=steve user-74=skyfirec user-75=alexadmin user-76=innovat1 user-77=askhform user-78=stuartge user-79=nativene user-80=brighto1 user-81=nstriton user-82=firstre2 user-83=vivienn1 user-84=battlere user-85=oneoarco user-86=bedfords user-87=ggaaorgu user-88=belle user-89=newstoda user-90=bemadonn user-91=milloyco user-92=gilpin user-93=elecleis user-94=hubmaster user-95=putterfi user-96=carsinyo user-97=fetch user-98=accooper user-99=ianrayne user-100=connectedshoppin user-101=thqkgnbz user-102=jonhartl user-103=seftvta
Sep 12 13:09:37 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=ultbcrra user-105=firstres user-106=coursemc user-107=opaiscyx user-108=clarkass user-109=firstrel user-110=costestimatorco user-111=firstred user-112=southlon user-113=highlegh user-114=martsblo user-115=dickemery123 user-116=ptkxhsbt user-117=lbhyisi user-118=hhdugcor user-119=magichat user-120=lakesan1 user-121=brmrjxl user-122=strathar user-123=sarafoundation user-124=atestord user-125=wilsonsw user-126=musorguk user-127=megacards user-128=jarvisin user-129=spectrum user-130=theblack user-131=hodgesonweb user-132=still user-133=agproduc user-134=stephani user-135=leereyn1 user-136=markward user-137=booff user-138=foundation user-139=connect9 user-140=athenare user-141=vantagep user-142=maflemin user-143=lbscrmod user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 13:09:37 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 13:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:39 nativespace-cdp sudo[1045310]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 13:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:39 nativespace-cdp sudo[1045320]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hEZNsZ1yqSQYyt9n.~
Sep 12 13:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:39 nativespace-cdp sudo[1045325]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hEZNsZ1yqSQYyt9n.~'
Sep 12 13:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:39 nativespace-cdp sudo[1045329]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hEZNsZ1yqSQYyt9n.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 13:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:39 nativespace-cdp sudo[1045335]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 13:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:39 nativespace-cdp sudo[1045340]: pam_unix(sudo:session): session closed for user root
Sep 12 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 13:09:53 nativespace-cdp sudo[1045410]: pam_unix(sudo:session): session closed for user root
Sep 12 13:11:33 nativespace-cdp sshd[1046145]: Connection closed by 159.100.136.21 port 41528 [preauth]
Sep 12 13:16:33 nativespace-cdp sshd[1048746]: Connection closed by 159.100.136.21 port 51738 [preauth]
Sep 12 13:21:33 nativespace-cdp sshd[1050877]: Connection closed by 159.100.136.21 port 33096 [preauth]
Sep 12 13:26:33 nativespace-cdp sshd[1052667]: Connection closed by 159.100.136.21 port 42800 [preauth]
Sep 12 13:31:33 nativespace-cdp sshd[1054853]: Connection closed by 159.100.136.21 port 52308 [preauth]
Sep 12 13:36:36 nativespace-cdp sshd[1056989]: Connection closed by 159.100.136.21 port 34216 [preauth]
Sep 12 13:41:36 nativespace-cdp sshd[1059610]: Connection closed by 159.100.136.21 port 43344 [preauth]
Sep 12 13:46:33 nativespace-cdp sshd[1062319]: Connection closed by 159.100.136.21 port 52976 [preauth]
Sep 12 13:51:33 nativespace-cdp sshd[1065005]: Connection closed by 159.100.136.21 port 34148 [preauth]
Sep 12 13:56:33 nativespace-cdp sshd[1066315]: Connection closed by 159.100.136.21 port 43478 [preauth]
Sep 12 14:01:35 nativespace-cdp sshd[1067956]: Connection closed by 159.100.136.21 port 52728 [preauth]
Sep 12 14:06:36 nativespace-cdp sshd[1069568]: Connection closed by 159.100.136.21 port 33466 [preauth]
Sep 12 14:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 14:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:35 nativespace-cdp sudo[1070217]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 14:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:35 nativespace-cdp sudo[1070222]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 14:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:37 nativespace-cdp sudo[1070227]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 14:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:37 nativespace-cdp sudo[1070238]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 14:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:40 nativespace-cdp sudo[1070244]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:40 nativespace-cdp sudo[1070260]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 14:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:40 nativespace-cdp sudo[1070265]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:41 nativespace-cdp sudo[1070269]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:41 nativespace-cdp sudo[1070274]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:41 nativespace-cdp sudo[1070280]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:41 nativespace-cdp sudo[1070285]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:49 nativespace-cdp sudo[1070324]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 14:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:50 nativespace-cdp sudo[1070334]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=philmcph user-2=ctedorgu user-3=donnychicago user-4=steakbridieme user-5=firstre5 user-6=lkpier user-7=health2045 user-8=fortunaz user-9=foods user-10=leftie user-11=putterfc user-12=nscdp user-13=tigerlet user-14=barbersh user-15=hidden user-16=nomistakes user-17=smrszyqg user-18=isleofwi user-19=pugwash user-20=paulmca1 user-21=howardon user-22=cwsocial user-23=ninejimm user-24=reliable user-25=cambria1 user-26=cathski user-27=courseme user-28=eugincou user-29=hirefootballgame user-30=sibtoncc user-31=asandcoc user-32=steve user-33=zebrapho user-34=bwppodcast user-35=nsceres user-36=burydropin user-37=fawcettd user-38=dhyana user-39=eatspam user-40=darkstar user-41=beauty user-42=boldover user-43=nove user-44=sosevalu user-45=crrtipdl user-46=bakery user-47=nvihkvu user-48=cath user-49=sketchy
Sep 12 14:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=havantho user-51=what user-52=tstardom user-53=oubpgvbx user-54=design user-55=kategilpin user-56=ladburyp user-57=dancinggardener user-58=stagingerris user-59=jennimil user-60=tomandle user-61=careers user-62=nbhavers user-63=david user-64=mcdermos user-65=chrisdal user-66=onlycont user-67=attlebor user-68=lucy user-69=romaldki user-70=branko user-71=hodgsonmail user-72=ranxterc user-73=outdoorc user-74=sarafoundation user-75=atestord user-76=strathar user-77=brmrjxl user-78=lakesan1 user-79=musorguk user-80=megacards user-81=wilsonsw user-82=ptkxhsbt user-83=dickemery123 user-84=martsblo user-85=magichat user-86=lbhyisi user-87=hhdugcor user-88=maflemin user-89=lbscrmod user-90=athenare user-91=connect9 user-92=vantagep user-93=markward user-94=booff user-95=foundation user-96=ulsukarm user-97=hodgesonweb user-98=theblack user-99=spectrum user-100=jarvisin user-101=leereyn1 user-102=stephani
Sep 12 14:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=still user-104=agproduc user-105=battlere user-106=oneoarco user-107=firstre2 user-108=vivienn1 user-109=brighto1 user-110=nstriton user-111=bemadonn user-112=ggaaorgu user-113=belle user-114=newstoda user-115=bedfords user-116=skyfirec user-117=alexadmin user-118=nativene user-119=stuartge user-120=askhform user-121=innovat1 user-122=opaiscyx user-123=coursemc user-124=firstres user-125=seftvta user-126=jonhartl user-127=ultbcrra user-128=southlon user-129=highlegh user-130=firstred user-131=costestimatorco user-132=firstrel user-133=clarkass user-134=carsinyo user-135=fetch user-136=putterfi user-137=hubmaster user-138=elecleis user-139=gilpin user-140=milloyco user-141=thqkgnbz user-142=connectedshoppin user-143=ianrayne user-144=accooper feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 14:09:50 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 14:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:51 nativespace-cdp sudo[1070343]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 14:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:52 nativespace-cdp sudo[1070352]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-iXb5HB2feHbdWMjv.~
Sep 12 14:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:52 nativespace-cdp sudo[1070357]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-iXb5HB2feHbdWMjv.~'
Sep 12 14:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:52 nativespace-cdp sudo[1070361]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-iXb5HB2feHbdWMjv.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 14:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:52 nativespace-cdp sudo[1070367]: pam_unix(sudo:session): session closed for user root
Sep 12 14:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 14:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:09:52 nativespace-cdp sudo[1070372]: pam_unix(sudo:session): session closed for user root
Sep 12 14:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 14:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 14:10:09 nativespace-cdp sudo[1070626]: pam_unix(sudo:session): session closed for user root
Sep 12 14:11:33 nativespace-cdp sshd[1071171]: Connection closed by 159.100.136.21 port 41644 [preauth]
Sep 12 14:16:33 nativespace-cdp sshd[1072705]: Connection closed by 159.100.136.21 port 50796 [preauth]
Sep 12 14:21:33 nativespace-cdp sshd[1073969]: Connection closed by 159.100.136.21 port 59600 [preauth]
Sep 12 14:26:36 nativespace-cdp sshd[1075337]: Connection closed by 159.100.136.21 port 40916 [preauth]
Sep 12 14:31:34 nativespace-cdp sshd[1076764]: Connection closed by 159.100.136.21 port 49430 [preauth]
Sep 12 14:36:33 nativespace-cdp sshd[1078249]: Connection closed by 159.100.136.21 port 59022 [preauth]
Sep 12 14:41:33 nativespace-cdp sshd[1079829]: Connection closed by 159.100.136.21 port 40100 [preauth]
Sep 12 14:46:33 nativespace-cdp sshd[1081314]: Connection closed by 159.100.136.21 port 49768 [preauth]
Sep 12 14:51:33 nativespace-cdp sshd[1082527]: Connection closed by 159.100.136.21 port 59226 [preauth]
Sep 12 14:56:35 nativespace-cdp sshd[1083853]: Connection closed by 159.100.136.21 port 40132 [preauth]
Sep 12 15:01:34 nativespace-cdp sshd[1085740]: Connection closed by 159.100.136.21 port 48868 [preauth]
Sep 12 15:06:35 nativespace-cdp sshd[1087018]: Connection closed by 159.100.136.21 port 58500 [preauth]
Sep 12 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:36 nativespace-cdp sudo[1087906]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:36 nativespace-cdp sudo[1087910]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:37 nativespace-cdp sudo[1087915]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 15:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:37 nativespace-cdp sudo[1087927]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 15:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:41 nativespace-cdp sudo[1087933]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:41 nativespace-cdp sudo[1088004]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:41 nativespace-cdp sudo[1088009]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:41 nativespace-cdp sudo[1088013]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:41 nativespace-cdp sudo[1088019]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:41 nativespace-cdp sudo[1088025]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 15:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:41 nativespace-cdp sudo[1088030]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 15:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:49 nativespace-cdp sudo[1088127]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 15:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:51 nativespace-cdp sudo[1088148]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tstardom user-2=oubpgvbx user-3=what user-4=sketchy user-5=cath user-6=havantho user-7=nvihkvu user-8=ladburyp user-9=stagingerris user-10=dancinggardener user-11=kategilpin user-12=design user-13=nove user-14=boldover user-15=bakery user-16=sosevalu user-17=crrtipdl user-18=attlebor user-19=lucy user-20=onlycont user-21=outdoorc user-22=hodgsonmail user-23=ranxterc user-24=branko user-25=romaldki user-26=tomandle user-27=jennimil user-28=chrisdal user-29=mcdermos user-30=careers user-31=nbhavers user-32=david user-33=cambria1 user-34=cathski user-35=ninejimm user-36=reliable user-37=paulmca1 user-38=pugwash user-39=howardon user-40=cwsocial user-41=hirefootballgame user-42=eugincou user-43=courseme user-44=putterfc user-45=nscdp user-46=health2045 user-47=fortunaz user-48=leftie user-49=foods
Sep 12 15:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=lkpier user-51=philmcph user-52=ctedorgu user-53=firstre5 user-54=donnychicago user-55=steakbridieme user-56=smrszyqg user-57=isleofwi user-58=hidden user-59=nomistakes user-60=tigerlet user-61=barbersh user-62=burydropin user-63=fawcettd user-64=nsceres user-65=beauty user-66=eatspam user-67=darkstar user-68=dhyana user-69=asandcoc user-70=sibtoncc user-71=bwppodcast user-72=zebrapho user-73=steve user-74=alexadmin user-75=skyfirec user-76=innovat1 user-77=stuartge user-78=askhform user-79=nativene user-80=brighto1 user-81=nstriton user-82=firstre2 user-83=vivienn1 user-84=battlere user-85=oneoarco user-86=bedfords user-87=ggaaorgu user-88=belle user-89=newstoda user-90=bemadonn user-91=gilpin user-92=milloyco user-93=elecleis user-94=hubmaster user-95=putterfi user-96=carsinyo user-97=fetch user-98=accooper user-99=ianrayne user-100=connectedshoppin user-101=thqkgnbz user-102=jonhartl user-103=seftvta
Sep 12 15:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=ultbcrra user-105=firstres user-106=opaiscyx user-107=coursemc user-108=firstrel user-109=clarkass user-110=costestimatorco user-111=firstred user-112=southlon user-113=highlegh user-114=martsblo user-115=dickemery123 user-116=ptkxhsbt user-117=lbhyisi user-118=hhdugcor user-119=magichat user-120=lakesan1 user-121=brmrjxl user-122=strathar user-123=sarafoundation user-124=atestord user-125=wilsonsw user-126=musorguk user-127=megacards user-128=jarvisin user-129=spectrum user-130=theblack user-131=hodgesonweb user-132=still user-133=agproduc user-134=stephani user-135=leereyn1 user-136=booff user-137=markward user-138=foundation user-139=connect9 user-140=athenare user-141=vantagep user-142=maflemin user-143=lbscrmod user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 15:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 15:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:52 nativespace-cdp sudo[1088166]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 15:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:52 nativespace-cdp sudo[1088174]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aAetJRsWCWlwXHWv.~
Sep 12 15:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:52 nativespace-cdp sudo[1088179]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aAetJRsWCWlwXHWv.~'
Sep 12 15:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:52 nativespace-cdp sudo[1088184]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aAetJRsWCWlwXHWv.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 15:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:52 nativespace-cdp sudo[1088189]: pam_unix(sudo:session): session closed for user root
Sep 12 15:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 15:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:09:52 nativespace-cdp sudo[1088194]: pam_unix(sudo:session): session closed for user root
Sep 12 15:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 15:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 15:10:00 nativespace-cdp sudo[1088244]: pam_unix(sudo:session): session closed for user root
Sep 12 15:11:33 nativespace-cdp sshd[1088927]: Connection closed by 159.100.136.21 port 38970 [preauth]
Sep 12 15:16:34 nativespace-cdp sshd[1090303]: Connection closed by 159.100.136.21 port 48368 [preauth]
Sep 12 15:21:33 nativespace-cdp sshd[1091575]: Connection closed by 159.100.136.21 port 57798 [preauth]
Sep 12 15:26:35 nativespace-cdp sshd[1092825]: Connection closed by 159.100.136.21 port 39090 [preauth]
Sep 12 15:31:33 nativespace-cdp sshd[1094036]: Connection closed by 159.100.136.21 port 48694 [preauth]
Sep 12 15:36:33 nativespace-cdp sshd[1095226]: Connection closed by 159.100.136.21 port 57710 [preauth]
Sep 12 15:46:33 nativespace-cdp sshd[1098336]: Connection closed by 159.100.136.21 port 48468 [preauth]
Sep 12 15:51:34 nativespace-cdp sshd[1099466]: Connection closed by 159.100.136.21 port 57898 [preauth]
Sep 12 15:56:34 nativespace-cdp sshd[1101016]: Connection closed by 159.100.136.21 port 38622 [preauth]
Sep 12 16:01:34 nativespace-cdp sshd[1102213]: Connection closed by 159.100.136.21 port 47222 [preauth]
Sep 12 16:06:33 nativespace-cdp sshd[1103514]: Connection closed by 159.100.136.21 port 56264 [preauth]
Sep 12 16:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 16:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:30 nativespace-cdp sudo[1104174]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 16:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:30 nativespace-cdp sudo[1104178]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 16:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:31 nativespace-cdp sudo[1104183]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 16:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:31 nativespace-cdp sudo[1104191]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 16:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:34 nativespace-cdp sudo[1104197]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 16:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:34 nativespace-cdp sudo[1104211]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 16:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:34 nativespace-cdp sudo[1104216]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 16:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:34 nativespace-cdp sudo[1104220]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 16:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:34 nativespace-cdp sudo[1104225]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 16:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:35 nativespace-cdp sudo[1104230]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 16:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:35 nativespace-cdp sudo[1104236]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:37 nativespace-cdp sudo[1104250]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:37 nativespace-cdp sudo[1104256]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=steve user-2=bwppodcast user-3=zebrapho user-4=asandcoc user-5=sibtoncc user-6=dhyana user-7=beauty user-8=eatspam user-9=darkstar user-10=nsceres user-11=burydropin user-12=fawcettd user-13=hidden user-14=nomistakes user-15=barbersh user-16=tigerlet user-17=smrszyqg user-18=isleofwi user-19=lkpier user-20=ctedorgu user-21=philmcph user-22=steakbridieme user-23=donnychicago user-24=firstre5 user-25=putterfc user-26=nscdp user-27=fortunaz user-28=health2045 user-29=foods user-30=leftie user-31=eugincou user-32=courseme user-33=hirefootballgame user-34=paulmca1 user-35=howardon user-36=pugwash user-37=cwsocial user-38=cathski user-39=cambria1 user-40=ninejimm user-41=reliable user-42=careers user-43=nbhavers user-44=david user-45=chrisdal user-46=mcdermos user-47=jennimil user-48=tomandle
Sep 12 16:09:37 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=outdoorc user-51=hodgsonmail user-52=ranxterc user-53=branko user-54=onlycont user-55=attlebor user-56=lucy user-57=bakery user-58=sosevalu user-59=crrtipdl user-60=boldover user-61=nove user-62=design user-63=ladburyp user-64=dancinggardener user-65=stagingerris user-66=kategilpin user-67=sketchy user-68=cath user-69=havantho user-70=nvihkvu user-71=oubpgvbx user-72=tstardom user-73=what user-74=ulsukarm user-75=athenare user-76=connect9 user-77=vantagep user-78=maflemin user-79=lbscrmod user-80=markward user-81=booff user-82=foundation user-83=stephani user-84=leereyn1 user-85=still user-86=agproduc user-87=spectrum user-88=hodgesonweb user-89=theblack user-90=jarvisin user-91=musorguk user-92=megacards user-93=wilsonsw user-94=strathar user-95=sarafoundation user-96=atestord user-97=brmrjxl user-98=lakesan1 user-99=magichat user-100=lbhyisi user-101=hhdugcor user-102=dickemery123
Sep 12 16:09:37 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ptkxhsbt user-104=martsblo user-105=firstred user-106=southlon user-107=highlegh user-108=clarkass user-109=firstrel user-110=costestimatorco user-111=opaiscyx user-112=coursemc user-113=jonhartl user-114=seftvta user-115=ultbcrra user-116=firstres user-117=connectedshoppin user-118=thqkgnbz user-119=accooper user-120=ianrayne user-121=hubmaster user-122=putterfi user-123=carsinyo user-124=fetch user-125=milloyco user-126=gilpin user-127=elecleis user-128=ggaaorgu user-129=belle user-130=newstoda user-131=bemadonn user-132=bedfords user-133=firstre2 user-134=vivienn1 user-135=battlere user-136=oneoarco user-137=brighto1 user-138=nstriton user-139=nativene user-140=innovat1 user-141=askhform user-142=stuartge user-143=skyfirec user-144=alexadmin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 16:09:37 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 16:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:38 nativespace-cdp sudo[1104263]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:38 nativespace-cdp sudo[1104274]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5AUomX9J6dpVi6tH.~
Sep 12 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:38 nativespace-cdp sudo[1104279]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5AUomX9J6dpVi6tH.~'
Sep 12 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:38 nativespace-cdp sudo[1104283]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-5AUomX9J6dpVi6tH.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:38 nativespace-cdp sudo[1104289]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 16:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:38 nativespace-cdp sudo[1104294]: pam_unix(sudo:session): session closed for user root
Sep 12 16:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 16:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 16:09:44 nativespace-cdp sudo[1104324]: pam_unix(sudo:session): session closed for user root
Sep 12 16:11:34 nativespace-cdp sshd[1105105]: Connection closed by 159.100.136.21 port 36888 [preauth]
Sep 12 16:16:33 nativespace-cdp sshd[1106552]: Connection closed by 159.100.136.21 port 46454 [preauth]
Sep 12 16:21:33 nativespace-cdp sshd[1107768]: Connection closed by 159.100.136.21 port 55564 [preauth]
Sep 12 16:26:33 nativespace-cdp sshd[1109103]: Connection closed by 159.100.136.21 port 36750 [preauth]
Sep 12 16:31:33 nativespace-cdp sshd[1110360]: Connection closed by 159.100.136.21 port 46176 [preauth]
Sep 12 16:36:34 nativespace-cdp sshd[1111891]: Connection closed by 159.100.136.21 port 55904 [preauth]
Sep 12 16:41:36 nativespace-cdp sshd[1113291]: Connection closed by 159.100.136.21 port 37128 [preauth]
Sep 12 16:46:37 nativespace-cdp sshd[1114853]: Connection closed by 159.100.136.21 port 46626 [preauth]
Sep 12 16:51:36 nativespace-cdp sshd[1116074]: Connection closed by 159.100.136.21 port 55892 [preauth]
Sep 12 16:56:33 nativespace-cdp sshd[1117247]: Connection closed by 159.100.136.21 port 37054 [preauth]
Sep 12 17:01:33 nativespace-cdp sshd[1118936]: Connection closed by 159.100.136.21 port 46414 [preauth]
Sep 12 17:06:33 nativespace-cdp sshd[1120295]: Connection closed by 159.100.136.21 port 55920 [preauth]
Sep 12 17:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 17:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:34 nativespace-cdp sudo[1120968]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 17:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:34 nativespace-cdp sudo[1120973]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 17:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:36 nativespace-cdp sudo[1120978]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 17:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:36 nativespace-cdp sudo[1120985]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 17:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:52 nativespace-cdp sudo[1120991]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 17:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:53 nativespace-cdp sudo[1121054]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 17:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:53 nativespace-cdp sudo[1121059]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 17:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:53 nativespace-cdp sudo[1121063]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 17:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:53 nativespace-cdp sudo[1121068]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 17:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:53 nativespace-cdp sudo[1121073]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 17:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:53 nativespace-cdp sudo[1121079]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 17:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:55 nativespace-cdp sudo[1121089]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 17:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:55 nativespace-cdp sudo[1121096]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=asandcoc user-2=sibtoncc user-3=bwppodcast user-4=zebrapho user-5=steve user-6=burydropin user-7=fawcettd user-8=nsceres user-9=beauty user-10=eatspam user-11=darkstar user-12=dhyana user-13=putterfc user-14=nscdp user-15=health2045 user-16=fortunaz user-17=foods user-18=leftie user-19=lkpier user-20=philmcph user-21=ctedorgu user-22=firstre5 user-23=steakbridieme user-24=donnychicago user-25=isleofwi user-26=smrszyqg user-27=hidden user-28=nomistakes user-29=barbersh user-30=tigerlet user-31=cathski user-32=cambria1 user-33=reliable user-34=ninejimm user-35=paulmca1 user-36=pugwash user-37=howardon user-38=cwsocial user-39=hirefootballgame user-40=eugincou user-41=courseme user-42=tomandle user-43=jennimil user-44=chrisdal user-45=mcdermos user-46=nbhavers user-47=careers user-48=david
Sep 12 17:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=attlebor user-50=lucy user-51=onlycont user-52=hodgsonmail user-53=ranxterc user-54=outdoorc user-55=branko user-56=romaldki user-57=nove user-58=boldover user-59=bakery user-60=sosevalu user-61=crrtipdl user-62=tstardom user-63=oubpgvbx user-64=what user-65=cath user-66=sketchy user-67=havantho user-68=nvihkvu user-69=ladburyp user-70=dancinggardener user-71=stagingerris user-72=kategilpin user-73=design user-74=markward user-75=booff user-76=foundation user-77=connect9 user-78=athenare user-79=vantagep user-80=maflemin user-81=lbscrmod user-82=ulsukarm user-83=jarvisin user-84=spectrum user-85=hodgesonweb user-86=theblack user-87=still user-88=agproduc user-89=stephani user-90=leereyn1 user-91=lakesan1 user-92=brmrjxl user-93=strathar user-94=sarafoundation user-95=atestord user-96=wilsonsw user-97=musorguk user-98=megacards user-99=martsblo user-100=dickemery123 user-101=ptkxhsbt user-102=lbhyisi
Sep 12 17:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=hhdugcor user-104=magichat user-105=jonhartl user-106=seftvta user-107=ultbcrra user-108=firstres user-109=coursemc user-110=opaiscyx user-111=clarkass user-112=firstrel user-113=costestimatorco user-114=firstred user-115=southlon user-116=highlegh user-117=milloyco user-118=gilpin user-119=elecleis user-120=hubmaster user-121=putterfi user-122=carsinyo user-123=fetch user-124=accooper user-125=ianrayne user-126=connectedshoppin user-127=thqkgnbz user-128=brighto1 user-129=nstriton user-130=firstre2 user-131=vivienn1 user-132=battlere user-133=oneoarco user-134=bedfords user-135=ggaaorgu user-136=belle user-137=newstoda user-138=bemadonn user-139=skyfirec user-140=alexadmin user-141=innovat1 user-142=askhform user-143=stuartge user-144=nativene feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 17:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 17:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:56 nativespace-cdp sudo[1121104]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 17:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:57 nativespace-cdp sudo[1121115]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7HJFLThy0ifSgp87.~
Sep 12 17:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:57 nativespace-cdp sudo[1121120]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7HJFLThy0ifSgp87.~'
Sep 12 17:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:57 nativespace-cdp sudo[1121124]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7HJFLThy0ifSgp87.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 17:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:57 nativespace-cdp sudo[1121130]: pam_unix(sudo:session): session closed for user root
Sep 12 17:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 17:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:09:57 nativespace-cdp sudo[1121135]: pam_unix(sudo:session): session closed for user root
Sep 12 17:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 17:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 17:10:10 nativespace-cdp sudo[1121317]: pam_unix(sudo:session): session closed for user root
Sep 12 17:11:35 nativespace-cdp sshd[1121741]: Connection closed by 159.100.136.21 port 37318 [preauth]
Sep 12 17:16:35 nativespace-cdp sshd[1123292]: Connection closed by 159.100.136.21 port 47180 [preauth]
Sep 12 17:21:33 nativespace-cdp sshd[1124560]: Connection closed by 159.100.136.21 port 56474 [preauth]
Sep 12 17:26:33 nativespace-cdp sshd[1125934]: Connection closed by 159.100.136.21 port 37496 [preauth]
Sep 12 17:30:55 nativespace-cdp sshd[1127074]: Bad protocol version identification '\003' from 194.165.16.72 port 65042
Sep 12 17:31:33 nativespace-cdp sshd[1127478]: Connection closed by 159.100.136.21 port 46942 [preauth]
Sep 12 17:36:33 nativespace-cdp sshd[1128578]: Connection closed by 159.100.136.21 port 55378 [preauth]
Sep 12 17:41:34 nativespace-cdp sshd[1129790]: Connection closed by 159.100.136.21 port 36250 [preauth]
Sep 12 17:46:34 nativespace-cdp sshd[1131236]: Connection closed by 159.100.136.21 port 45946 [preauth]
Sep 12 17:51:35 nativespace-cdp sshd[1132579]: Connection closed by 159.100.136.21 port 55194 [preauth]
Sep 12 17:56:36 nativespace-cdp sshd[1133891]: Connection closed by 159.100.136.21 port 36506 [preauth]
Sep 12 17:58:59 nativespace-cdp sshd[1134711]: Invalid user kafka from 128.199.147.72 port 40652
Sep 12 17:58:59 nativespace-cdp sshd[1134711]: input_userauth_request: invalid user kafka [preauth]
Sep 12 17:59:00 nativespace-cdp sshd[1134711]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 17:59:00 nativespace-cdp sshd[1134711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.147.72
Sep 12 17:59:01 nativespace-cdp sshd[1134711]: Failed password for invalid user kafka from 128.199.147.72 port 40652 ssh2
Sep 12 17:59:02 nativespace-cdp sshd[1134711]: Received disconnect from 128.199.147.72 port 40652:11: Bye Bye [preauth]
Sep 12 17:59:02 nativespace-cdp sshd[1134711]: Disconnected from 128.199.147.72 port 40652 [preauth]
Sep 12 18:01:33 nativespace-cdp sshd[1135888]: Connection closed by 159.100.136.21 port 44610 [preauth]
Sep 12 18:02:31 nativespace-cdp sshd[1136058]: Invalid user test2 from 128.199.147.72 port 52254
Sep 12 18:02:31 nativespace-cdp sshd[1136058]: input_userauth_request: invalid user test2 [preauth]
Sep 12 18:02:31 nativespace-cdp sshd[1136058]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 18:02:31 nativespace-cdp sshd[1136058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.147.72
Sep 12 18:02:34 nativespace-cdp sshd[1136058]: Failed password for invalid user test2 from 128.199.147.72 port 52254 ssh2
Sep 12 18:02:36 nativespace-cdp sshd[1136058]: Received disconnect from 128.199.147.72 port 52254:11: Bye Bye [preauth]
Sep 12 18:02:36 nativespace-cdp sshd[1136058]: Disconnected from 128.199.147.72 port 52254 [preauth]
Sep 12 18:03:22 nativespace-cdp sshd[1136350]: Invalid user ubuntu from 128.199.147.72 port 37476
Sep 12 18:03:22 nativespace-cdp sshd[1136350]: input_userauth_request: invalid user ubuntu [preauth]
Sep 12 18:03:23 nativespace-cdp sshd[1136350]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 18:03:23 nativespace-cdp sshd[1136350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.147.72
Sep 12 18:03:24 nativespace-cdp sshd[1136350]: Failed password for invalid user ubuntu from 128.199.147.72 port 37476 ssh2
Sep 12 18:03:27 nativespace-cdp sshd[1136350]: Received disconnect from 128.199.147.72 port 37476:11: Bye Bye [preauth]
Sep 12 18:03:27 nativespace-cdp sshd[1136350]: Disconnected from 128.199.147.72 port 37476 [preauth]
Sep 12 18:06:33 nativespace-cdp sshd[1137123]: Connection closed by 159.100.136.21 port 53428 [preauth]
Sep 12 18:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 18:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:37 nativespace-cdp sudo[1137794]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 18:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:37 nativespace-cdp sudo[1137798]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 18:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:38 nativespace-cdp sudo[1137803]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 18:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:38 nativespace-cdp sudo[1137810]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 18:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:42 nativespace-cdp sudo[1137816]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:42 nativespace-cdp sudo[1137835]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:42 nativespace-cdp sudo[1137840]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:42 nativespace-cdp sudo[1137844]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:42 nativespace-cdp sudo[1137849]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:42 nativespace-cdp sudo[1137855]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 18:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:42 nativespace-cdp sudo[1137860]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 18:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:55 nativespace-cdp sudo[1137909]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 18:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:56 nativespace-cdp sudo[1137916]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=eugincou user-2=courseme user-3=hirefootballgame user-4=cwsocial user-5=howardon user-6=paulmca1 user-7=pugwash user-8=cathski user-9=cambria1 user-10=reliable user-11=ninejimm user-12=nomistakes user-13=hidden user-14=barbersh user-15=tigerlet user-16=isleofwi user-17=smrszyqg user-18=lkpier user-19=steakbridieme user-20=firstre5 user-21=donnychicago user-22=ctedorgu user-23=philmcph user-24=nscdp user-25=putterfc user-26=leftie user-27=foods user-28=fortunaz user-29=health2045 user-30=dhyana user-31=beauty user-32=darkstar user-33=eatspam user-34=nsceres user-35=fawcettd user-36=burydropin user-37=steve user-38=bwppodcast user-39=zebrapho user-40=asandcoc user-41=sibtoncc user-42=design user-43=dancinggardener user-44=stagingerris user-45=ladburyp user-46=kategilpin user-47=havantho
Sep 12 18:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=cath user-49=sketchy user-50=nvihkvu user-51=tstardom user-52=oubpgvbx user-53=what user-54=bakery user-55=crrtipdl user-56=sosevalu user-57=boldover user-58=nove user-59=romaldki user-60=ranxterc user-61=hodgsonmail user-62=outdoorc user-63=branko user-64=onlycont user-65=lucy user-66=attlebor user-67=david user-68=nbhavers user-69=careers user-70=chrisdal user-71=mcdermos user-72=jennimil user-73=tomandle user-74=magichat user-75=hhdugcor user-76=lbhyisi user-77=dickemery123 user-78=ptkxhsbt user-79=martsblo user-80=megacards user-81=musorguk user-82=wilsonsw user-83=strathar user-84=atestord user-85=sarafoundation user-86=brmrjxl user-87=lakesan1 user-88=stephani user-89=leereyn1 user-90=agproduc user-91=still user-92=spectrum user-93=theblack user-94=hodgesonweb user-95=jarvisin user-96=ulsukarm user-97=vantagep user-98=athenare user-99=connect9 user-100=lbscrmod user-101=maflemin user-102=markward
Sep 12 18:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=booff user-104=foundation user-105=nativene user-106=innovat1 user-107=askhform user-108=stuartge user-109=skyfirec user-110=alexadmin user-111=newstoda user-112=ggaaorgu user-113=belle user-114=bemadonn user-115=bedfords user-116=vivienn1 user-117=firstre2 user-118=oneoarco user-119=battlere user-120=nstriton user-121=brighto1 user-122=connectedshoppin user-123=thqkgnbz user-124=accooper user-125=ianrayne user-126=hubmaster user-127=putterfi user-128=fetch user-129=carsinyo user-130=milloyco user-131=gilpin user-132=elecleis user-133=firstred user-134=highlegh user-135=southlon user-136=firstrel user-137=clarkass user-138=costestimatorco user-139=coursemc user-140=opaiscyx user-141=ultbcrra user-142=seftvta user-143=jonhartl user-144=firstres feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 18:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 18:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:57 nativespace-cdp sudo[1137926]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:58 nativespace-cdp sudo[1137934]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dFweG8uaiBhHNT1R.~
Sep 12 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:58 nativespace-cdp sudo[1137939]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dFweG8uaiBhHNT1R.~'
Sep 12 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:58 nativespace-cdp sudo[1137943]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dFweG8uaiBhHNT1R.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:58 nativespace-cdp sudo[1137949]: pam_unix(sudo:session): session closed for user root
Sep 12 18:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 18:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:09:58 nativespace-cdp sudo[1137954]: pam_unix(sudo:session): session closed for user root
Sep 12 18:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 18:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 18:10:20 nativespace-cdp sudo[1138207]: pam_unix(sudo:session): session closed for user root
Sep 12 18:11:33 nativespace-cdp sshd[1138499]: Connection closed by 159.100.136.21 port 34360 [preauth]
Sep 12 18:16:33 nativespace-cdp sshd[1139714]: Connection closed by 159.100.136.21 port 43864 [preauth]
Sep 12 18:21:33 nativespace-cdp sshd[1141087]: Connection closed by 159.100.136.21 port 53026 [preauth]
Sep 12 18:26:33 nativespace-cdp sshd[1143146]: Connection closed by 159.100.136.21 port 33732 [preauth]
Sep 12 18:31:36 nativespace-cdp sshd[1144488]: Connection closed by 159.100.136.21 port 42768 [preauth]
Sep 12 18:36:33 nativespace-cdp sshd[1145763]: Connection closed by 159.100.136.21 port 52132 [preauth]
Sep 12 18:41:33 nativespace-cdp sshd[1147067]: Connection closed by 159.100.136.21 port 33486 [preauth]
Sep 12 18:46:33 nativespace-cdp sshd[1148688]: Connection closed by 159.100.136.21 port 43436 [preauth]
Sep 12 18:51:33 nativespace-cdp sshd[1149865]: Connection closed by 159.100.136.21 port 52326 [preauth]
Sep 12 18:56:37 nativespace-cdp sshd[1151243]: Connection closed by 159.100.136.21 port 33840 [preauth]
Sep 12 19:01:05 nativespace-cdp sshd[1152492]: Invalid user administrator from 186.18.85.108 port 35156
Sep 12 19:01:05 nativespace-cdp sshd[1152492]: input_userauth_request: invalid user administrator [preauth]
Sep 12 19:01:05 nativespace-cdp sshd[1152492]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 19:01:05 nativespace-cdp sshd[1152492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.18.85.108
Sep 12 19:01:07 nativespace-cdp sshd[1152492]: Failed password for invalid user administrator from 186.18.85.108 port 35156 ssh2
Sep 12 19:01:16 nativespace-cdp sshd[1152492]: Received disconnect from 186.18.85.108 port 35156:11: Bye Bye [preauth]
Sep 12 19:01:16 nativespace-cdp sshd[1152492]: Disconnected from 186.18.85.108 port 35156 [preauth]
Sep 12 19:01:36 nativespace-cdp sshd[1152570]: Connection closed by 159.100.136.21 port 42868 [preauth]
Sep 12 19:04:54 nativespace-cdp sshd[1153403]: Invalid user ftpuser from 217.15.160.86 port 56162
Sep 12 19:04:54 nativespace-cdp sshd[1153403]: input_userauth_request: invalid user ftpuser [preauth]
Sep 12 19:04:54 nativespace-cdp sshd[1153403]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 19:04:54 nativespace-cdp sshd[1153403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.15.160.86
Sep 12 19:04:57 nativespace-cdp sshd[1153403]: Failed password for invalid user ftpuser from 217.15.160.86 port 56162 ssh2
Sep 12 19:04:57 nativespace-cdp sshd[1153403]: Received disconnect from 217.15.160.86 port 56162:11: Bye Bye [preauth]
Sep 12 19:04:57 nativespace-cdp sshd[1153403]: Disconnected from 217.15.160.86 port 56162 [preauth]
Sep 12 19:06:33 nativespace-cdp sshd[1153926]: Connection closed by 159.100.136.21 port 52170 [preauth]
Sep 12 19:08:36 nativespace-cdp sshd[1154296]: Invalid user newuser from 186.18.85.108 port 47518
Sep 12 19:08:36 nativespace-cdp sshd[1154296]: input_userauth_request: invalid user newuser [preauth]
Sep 12 19:08:36 nativespace-cdp sshd[1154296]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 19:08:36 nativespace-cdp sshd[1154296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.18.85.108
Sep 12 19:08:38 nativespace-cdp sshd[1154296]: Failed password for invalid user newuser from 186.18.85.108 port 47518 ssh2
Sep 12 19:08:39 nativespace-cdp sshd[1154296]: Received disconnect from 186.18.85.108 port 47518:11: Bye Bye [preauth]
Sep 12 19:08:39 nativespace-cdp sshd[1154296]: Disconnected from 186.18.85.108 port 47518 [preauth]
Sep 12 19:09:05 nativespace-cdp sshd[1154452]: Invalid user test from 217.15.160.86 port 58390
Sep 12 19:09:05 nativespace-cdp sshd[1154452]: input_userauth_request: invalid user test [preauth]
Sep 12 19:09:05 nativespace-cdp sshd[1154452]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 19:09:05 nativespace-cdp sshd[1154452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.15.160.86
Sep 12 19:09:07 nativespace-cdp sshd[1154452]: Failed password for invalid user test from 217.15.160.86 port 58390 ssh2
Sep 12 19:09:07 nativespace-cdp sshd[1154452]: Received disconnect from 217.15.160.86 port 58390:11: Bye Bye [preauth]
Sep 12 19:09:07 nativespace-cdp sshd[1154452]: Disconnected from 217.15.160.86 port 58390 [preauth]
Sep 12 19:09:30 nativespace-cdp sshd[1154555]: Invalid user ftpuser from 186.18.85.108 port 58034
Sep 12 19:09:30 nativespace-cdp sshd[1154555]: input_userauth_request: invalid user ftpuser [preauth]
Sep 12 19:09:30 nativespace-cdp sshd[1154555]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 19:09:30 nativespace-cdp sshd[1154555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.18.85.108
Sep 12 19:09:33 nativespace-cdp sshd[1154555]: Failed password for invalid user ftpuser from 186.18.85.108 port 58034 ssh2
Sep 12 19:09:33 nativespace-cdp sshd[1154555]: Received disconnect from 186.18.85.108 port 58034:11: Bye Bye [preauth]
Sep 12 19:09:33 nativespace-cdp sshd[1154555]: Disconnected from 186.18.85.108 port 58034 [preauth]
Sep 12 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:35 nativespace-cdp sudo[1154583]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:35 nativespace-cdp sudo[1154588]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:37 nativespace-cdp sudo[1154593]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:37 nativespace-cdp sudo[1154602]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 19:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:40 nativespace-cdp sudo[1154609]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:40 nativespace-cdp sudo[1154630]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:40 nativespace-cdp sudo[1154636]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:40 nativespace-cdp sudo[1154641]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:40 nativespace-cdp sudo[1154646]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:40 nativespace-cdp sudo[1154652]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 19:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:40 nativespace-cdp sudo[1154657]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:43 nativespace-cdp sudo[1154692]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:43 nativespace-cdp sudo[1154698]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nstriton user-2=brighto1 user-3=oneoarco user-4=battlere user-5=vivienn1 user-6=firstre2 user-7=bedfords user-8=bemadonn user-9=newstoda user-10=belle user-11=ggaaorgu user-12=skyfirec user-13=alexadmin user-14=stuartge user-15=askhform user-16=innovat1 user-17=nativene user-18=firstres user-19=ultbcrra user-20=jonhartl user-21=seftvta user-22=coursemc user-23=opaiscyx user-24=costestimatorco user-25=firstrel user-26=clarkass user-27=highlegh user-28=southlon user-29=firstred user-30=elecleis user-31=milloyco user-32=gilpin user-33=fetch user-34=carsinyo user-35=putterfi user-36=hubmaster user-37=ianrayne user-38=accooper user-39=thqkgnbz user-40=connectedshoppin user-41=lakesan1 user-42=brmrjxl user-43=atestord user-44=sarafoundation user-45=strathar user-46=wilsonsw user-47=megacards
Sep 12 19:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=musorguk user-49=martsblo user-50=ptkxhsbt user-51=dickemery123 user-52=hhdugcor user-53=lbhyisi user-54=magichat user-55=foundation user-56=booff user-57=markward user-58=lbscrmod user-59=maflemin user-60=vantagep user-61=connect9 user-62=athenare user-63=ulsukarm user-64=jarvisin user-65=theblack user-66=hodgesonweb user-67=spectrum user-68=agproduc user-69=still user-70=leereyn1 user-71=stephani user-72=nove user-73=boldover user-74=crrtipdl user-75=sosevalu user-76=bakery user-77=what user-78=tstardom user-79=oubpgvbx user-80=nvihkvu user-81=havantho user-82=sketchy user-83=cath user-84=kategilpin user-85=stagingerris user-86=dancinggardener user-87=ladburyp user-88=design user-89=tomandle user-90=jennimil user-91=mcdermos user-92=chrisdal user-93=david user-94=nbhavers user-95=careers user-96=lucy user-97=attlebor user-98=onlycont user-99=branko user-100=hodgsonmail user-101=outdoorc
Sep 12 19:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ranxterc user-103=romaldki user-104=leftie user-105=foods user-106=health2045 user-107=fortunaz user-108=nscdp user-109=putterfc user-110=donnychicago user-111=steakbridieme user-112=firstre5 user-113=ctedorgu user-114=philmcph user-115=lkpier user-116=smrszyqg user-117=isleofwi user-118=tigerlet user-119=barbersh user-120=nomistakes user-121=hidden user-122=reliable user-123=ninejimm user-124=cambria1 user-125=cathski user-126=cwsocial user-127=howardon user-128=pugwash user-129=paulmca1 user-130=hirefootballgame user-131=courseme user-132=eugincou user-133=sibtoncc user-134=asandcoc user-135=zebrapho user-136=bwppodcast user-137=steve user-138=fawcettd user-139=burydropin user-140=nsceres user-141=darkstar user-142=eatspam user-143=beauty user-144=dhyana feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 12 19:09:43 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:45 nativespace-cdp sudo[1154707]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 19:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:46 nativespace-cdp sudo[1154733]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-epR9P7U4OP0fbsnD.~
Sep 12 19:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:46 nativespace-cdp sudo[1154739]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-epR9P7U4OP0fbsnD.~'
Sep 12 19:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:46 nativespace-cdp sudo[1154743]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-epR9P7U4OP0fbsnD.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 19:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:46 nativespace-cdp sudo[1154749]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 19:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:46 nativespace-cdp sudo[1154754]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:52 nativespace-cdp sshd[1154768]: Invalid user ftpuser from 217.15.160.86 port 33328
Sep 12 19:09:52 nativespace-cdp sshd[1154768]: input_userauth_request: invalid user ftpuser [preauth]
Sep 12 19:09:52 nativespace-cdp sshd[1154768]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 19:09:52 nativespace-cdp sshd[1154768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.15.160.86
Sep 12 19:09:53 nativespace-cdp sshd[1154768]: Failed password for invalid user ftpuser from 217.15.160.86 port 33328 ssh2
Sep 12 19:09:54 nativespace-cdp sshd[1154768]: Received disconnect from 217.15.160.86 port 33328:11: Bye Bye [preauth]
Sep 12 19:09:54 nativespace-cdp sshd[1154768]: Disconnected from 217.15.160.86 port 33328 [preauth]
Sep 12 19:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 gethostname --output=json
Sep 12 19:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 19:09:57 nativespace-cdp sudo[1154793]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Themes get_theme_base --output=json
Sep 12 19:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:57 nativespace-cdp sudo[1154802]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:58 nativespace-cdp sudo[1154805]: pam_unix(sudo:session): session closed for user root
Sep 12 19:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=nstriton WpToolkitNotification send_admin_vulnerability_found_notification 'message=WP Toolkit has detected new vulnerabilities on WordPress sites under your care. It is strongly recommended to update or disable vulnerable assets on these sites. You can also configure WP Toolkit to perform automatic actions when vulnerabilities are detected. <br/><br/>The following vulnerabilities need your attention because they have to be addressed manually:<br/><br/>    <table border='"'"'0'"'"' cellpadding='"'"'5'"'"' cellspacing='"'"'0'"'"' style="border: 1px solid #ccc; margin: 5px 0; color: #737373">#012        <colgroup>#012            <col />#012            <col width="50"/>#012            <col/>#012            <col/>#012        </colgroup>#012        <tr style="border-bottom: 1px solid #ccc">#012            <td>&nbsp;</td>#012            <td colspan="2">Site:
Sep 12 19:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) <span style="color: black">pinstripe.services</span></td>#012            <td align="right"><a href="https://nativespace-cdp.ns-cdp.com:2087/?goto_uri=/cgi/wp-toolkit/index.cgi#/list/id/13/checkSecurity/1/activeTab/1" target="_blank" style="white-space: nowrap; color: rgb(37, 156, 204); text-decoration: none">Open in panel</a></td>#012            <td>&nbsp;</td>#012        </tr>#012        <tr>#012            <td>&nbsp;</td>#012            <td align="center" valign="top"><span style="width: 67px; padding: 4px 6px; font-weight: 600; font-size: 14px; line-height: 16px; display: inline-block; text-align: center; white-space: nowrap; border-radius: 2px; color: rgb(153, 51, 0); background-color: rgb(252, 238, 215);">#012    Medium#012</span></td>#012            <td colspan="2">#012                <span style="color: black">Betheme | Responsive Multipurpose WordPress &amp; WooCommerce Theme &lt;= 27.5.5 - Authenticated (Author+) Stored Cross-Site
Sep 12 19:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) Scripting via SVG File</span><br/>#012                <div style="line-height: 1.5em; font-size: 0.9em">The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.</div>#012                <div style='"'"'line-height:1em;'"'"'><a target='"'"'_blank'"'"' href='"'"'https://wordfence.com'"'"' style='"'"'color: #737373; font-size: 0.7em; text-decoration: none;'"'"'>This record contains material that is subject to copyright.</a></div>#012                <b style="font-size: 0.8em">Source: <a target='"'"'_blank'"'"'
Sep 12 19:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) href='"'"'https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfaa23f-05df-423c-a5f6-02f2b714b5b6?source=api-prod'"'"' style='"'"'color: inherit; text-decoration: none;'"'"'>Wordfence</a></b>#012            </td>#012            <td>&nbsp;</td>#012        </tr>#012    </table><br/>More vulnerabilities were found, please go to WP Toolkit for the full list. <br/><br/>Automatic actions can be defined on the site autoupdate policy screen.' --output=json
Sep 12 19:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 19:09:58 nativespace-cdp sudo[1154816]: pam_unix(sudo:session): session closed for user root
Sep 12 19:11:33 nativespace-cdp sshd[1155351]: Connection closed by 159.100.136.21 port 33770 [preauth]
Sep 12 19:12:55 nativespace-cdp sshd[1155563]: Invalid user ftpuser from 104.28.206.182 port 63278
Sep 12 19:12:55 nativespace-cdp sshd[1155563]: input_userauth_request: invalid user ftpuser [preauth]
Sep 12 19:12:55 nativespace-cdp sshd[1155563]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 19:12:55 nativespace-cdp sshd[1155563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.206.182
Sep 12 19:12:58 nativespace-cdp sshd[1155563]: Failed password for invalid user ftpuser from 104.28.206.182 port 63278 ssh2
Sep 12 19:13:07 nativespace-cdp sshd[1155563]: Received disconnect from 104.28.206.182 port 63278:11: Bye Bye [preauth]
Sep 12 19:13:07 nativespace-cdp sshd[1155563]: Disconnected from 104.28.206.182 port 63278 [preauth]
Sep 12 19:14:02 nativespace-cdp sshd[1155966]: Invalid user deploy from 104.28.206.182 port 63394
Sep 12 19:14:02 nativespace-cdp sshd[1155966]: input_userauth_request: invalid user deploy [preauth]
Sep 12 19:14:02 nativespace-cdp sshd[1155966]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 19:14:02 nativespace-cdp sshd[1155966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.206.182
Sep 12 19:14:04 nativespace-cdp sshd[1155966]: Failed password for invalid user deploy from 104.28.206.182 port 63394 ssh2
Sep 12 19:14:22 nativespace-cdp sshd[1155966]: Received disconnect from 104.28.206.182 port 63394:11: Bye Bye [preauth]
Sep 12 19:14:22 nativespace-cdp sshd[1155966]: Disconnected from 104.28.206.182 port 63394 [preauth]
Sep 12 19:16:15 nativespace-cdp sshd[1156818]: Invalid user ts3 from 104.28.206.182 port 63284
Sep 12 19:16:15 nativespace-cdp sshd[1156818]: input_userauth_request: invalid user ts3 [preauth]
Sep 12 19:16:15 nativespace-cdp sshd[1156818]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 19:16:15 nativespace-cdp sshd[1156818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.206.182
Sep 12 19:16:16 nativespace-cdp sshd[1156818]: Failed password for invalid user ts3 from 104.28.206.182 port 63284 ssh2
Sep 12 19:16:17 nativespace-cdp sshd[1156818]: Received disconnect from 104.28.206.182 port 63284:11: Bye Bye [preauth]
Sep 12 19:16:17 nativespace-cdp sshd[1156818]: Disconnected from 104.28.206.182 port 63284 [preauth]
Sep 12 19:16:35 nativespace-cdp sshd[1156915]: Connection closed by 159.100.136.21 port 42882 [preauth]
Sep 12 19:18:41 nativespace-cdp sshd[1157414]: Connection closed by 104.28.157.23 port 45522 [preauth]
Sep 12 19:20:54 nativespace-cdp sshd[1158000]: Connection closed by 104.28.157.23 port 45331 [preauth]
Sep 12 19:21:35 nativespace-cdp sshd[1158112]: Connection closed by 159.100.136.21 port 51810 [preauth]
Sep 12 19:23:01 nativespace-cdp sshd[1158357]: Connection closed by 104.28.157.23 port 46421 [preauth]
Sep 12 19:25:14 nativespace-cdp sshd[1159004]: Connection closed by 104.28.157.23 port 46322 [preauth]
Sep 12 19:26:33 nativespace-cdp sshd[1159625]: Connection closed by 159.100.136.21 port 33114 [preauth]
Sep 12 19:29:31 nativespace-cdp sshd[1160438]: Connection closed by 104.28.157.23 port 46819 [preauth]
Sep 12 19:30:44 nativespace-cdp sshd[1160774]: Connection closed by 104.28.157.23 port 45115 [preauth]
Sep 12 19:31:36 nativespace-cdp sshd[1160954]: Connection closed by 159.100.136.21 port 40876 [preauth]
Sep 12 19:35:06 nativespace-cdp sshd[1161791]: Connection closed by 104.28.157.23 port 47392 [preauth]
Sep 12 19:36:33 nativespace-cdp sshd[1162116]: Connection closed by 159.100.136.21 port 49062 [preauth]
Sep 12 19:37:10 nativespace-cdp sshd[1162208]: Connection closed by 104.28.157.23 port 47397 [preauth]
Sep 12 19:38:26 nativespace-cdp sshd[1162412]: Connection closed by 104.28.157.23 port 47198 [preauth]
Sep 12 19:39:25 nativespace-cdp sshd[1162640]: Connection closed by 104.28.157.23 port 46126 [preauth]
Sep 12 19:40:27 nativespace-cdp sshd[1163004]: Connection closed by 104.28.157.23 port 47557 [preauth]
Sep 12 19:41:33 nativespace-cdp sshd[1163205]: Connection closed by 159.100.136.21 port 58540 [preauth]
Sep 12 19:41:34 nativespace-cdp sshd[1163212]: Connection closed by 104.28.157.23 port 46153 [preauth]
Sep 12 19:45:01 nativespace-cdp sshd[1164104]: Connection closed by 104.28.157.23 port 46390 [preauth]
Sep 12 19:46:33 nativespace-cdp sshd[1164504]: Connection closed by 159.100.136.21 port 39540 [preauth]
Sep 12 19:51:33 nativespace-cdp sshd[1165904]: Connection closed by 159.100.136.21 port 49250 [preauth]
Sep 12 19:56:33 nativespace-cdp sshd[1167054]: Connection closed by 159.100.136.21 port 58718 [preauth]
Sep 12 20:01:33 nativespace-cdp sshd[1168547]: Connection closed by 159.100.136.21 port 40074 [preauth]
Sep 12 20:06:33 nativespace-cdp sshd[1169926]: Connection closed by 159.100.136.21 port 49746 [preauth]
Sep 12 20:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 20:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:31 nativespace-cdp sudo[1170682]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 20:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:31 nativespace-cdp sudo[1170688]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 20:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:32 nativespace-cdp sudo[1170693]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 20:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:32 nativespace-cdp sudo[1170709]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 20:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:37 nativespace-cdp sudo[1170715]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 20:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:37 nativespace-cdp sudo[1170743]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 20:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:37 nativespace-cdp sudo[1170748]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 20:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:37 nativespace-cdp sudo[1170752]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 20:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:37 nativespace-cdp sudo[1170757]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 20:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:37 nativespace-cdp sudo[1170763]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 20:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:37 nativespace-cdp sudo[1170769]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 20:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:46 nativespace-cdp sudo[1170809]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 20:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:47 nativespace-cdp sudo[1170816]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=hodgesonweb user-3=theblack user-4=spectrum user-5=still user-6=agproduc user-7=leereyn1 user-8=stephani user-9=booff user-10=foundation user-11=markward user-12=maflemin user-13=lbscrmod user-14=athenare user-15=connect9 user-16=vantagep user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=lbhyisi user-22=hhdugcor user-23=magichat user-24=brmrjxl user-25=lakesan1 user-26=sarafoundation user-27=atestord user-28=strathar user-29=wilsonsw user-30=musorguk user-31=megacards user-32=elecleis user-33=milloyco user-34=gilpin user-35=carsinyo user-36=fetch user-37=hubmaster user-38=putterfi user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=seftvta user-45=jonhartl user-46=ultbcrra user-47=opaiscyx
Sep 12 20:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=coursemc user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=southlon user-53=highlegh user-54=firstred user-55=skyfirec user-56=alexadmin user-57=askhform user-58=stuartge user-59=innovat1 user-60=nativene user-61=brighto1 user-62=nstriton user-63=battlere user-64=oneoarco user-65=firstre2 user-66=vivienn1 user-67=bedfords user-68=bemadonn user-69=belle user-70=ggaaorgu user-71=newstoda user-72=burydropin user-73=fawcettd user-74=nsceres user-75=eatspam user-76=darkstar user-77=beauty user-78=dhyana user-79=sibtoncc user-80=asandcoc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=reliable user-85=ninejimm user-86=cathski user-87=cambria1 user-88=pugwash user-89=paulmca1 user-90=howardon user-91=cwsocial user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=fortunaz user-96=health2045 user-97=leftie user-98=foods user-99=putterfc user-100=nscdp user-101=ctedorgu
Sep 12 20:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=philmcph user-103=donnychicago user-104=firstre5 user-105=steakbridieme user-106=lkpier user-107=smrszyqg user-108=isleofwi user-109=barbersh user-110=tigerlet user-111=hidden user-112=nomistakes user-113=attlebor user-114=lucy user-115=onlycont user-116=branko user-117=ranxterc user-118=hodgsonmail user-119=outdoorc user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=careers user-126=nbhavers user-127=david user-128=what user-129=tstardom user-130=oubpgvbx user-131=nvihkvu user-132=sketchy user-133=cath user-134=havantho user-135=kategilpin user-136=ladburyp user-137=dancinggardener user-138=stagingerris user-139=design user-140=nove user-141=boldover user-142=sosevalu user-143=crrtipdl user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 20:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:47 nativespace-cdp sudo[1170823]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 20:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:48 nativespace-cdp sudo[1170832]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-sG7wqRiyGfKbEiQn.~
Sep 12 20:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:48 nativespace-cdp sudo[1170837]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-sG7wqRiyGfKbEiQn.~'
Sep 12 20:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:48 nativespace-cdp sudo[1170841]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-sG7wqRiyGfKbEiQn.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 20:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:48 nativespace-cdp sudo[1170847]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 20:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:48 nativespace-cdp sudo[1170852]: pam_unix(sudo:session): session closed for user root
Sep 12 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 20:09:54 nativespace-cdp sudo[1170888]: pam_unix(sudo:session): session closed for user root
Sep 12 20:11:33 nativespace-cdp sshd[1171823]: Connection closed by 159.100.136.21 port 59358 [preauth]
Sep 12 20:16:33 nativespace-cdp sshd[1173424]: Connection closed by 159.100.136.21 port 41090 [preauth]
Sep 12 20:21:33 nativespace-cdp sshd[1174798]: Connection closed by 159.100.136.21 port 50660 [preauth]
Sep 12 20:26:35 nativespace-cdp sshd[1176000]: Connection closed by 159.100.136.21 port 60484 [preauth]
Sep 12 20:31:33 nativespace-cdp sshd[1177689]: Connection closed by 159.100.136.21 port 39900 [preauth]
Sep 12 20:36:33 nativespace-cdp sshd[1178854]: Connection closed by 159.100.136.21 port 49878 [preauth]
Sep 12 20:41:33 nativespace-cdp sshd[1180032]: Connection closed by 159.100.136.21 port 59108 [preauth]
Sep 12 20:46:33 nativespace-cdp sshd[1181395]: Connection closed by 159.100.136.21 port 39886 [preauth]
Sep 12 20:51:33 nativespace-cdp sshd[1182897]: Connection closed by 159.100.136.21 port 48678 [preauth]
Sep 12 20:56:33 nativespace-cdp sshd[1184154]: Connection closed by 159.100.136.21 port 58096 [preauth]
Sep 12 21:01:33 nativespace-cdp sshd[1185648]: Connection closed by 159.100.136.21 port 39328 [preauth]
Sep 12 21:06:36 nativespace-cdp sshd[1186796]: Connection closed by 159.100.136.21 port 49050 [preauth]
Sep 12 21:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 21:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:35 nativespace-cdp sudo[1187470]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 21:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:35 nativespace-cdp sudo[1187474]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 21:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:38 nativespace-cdp sudo[1187479]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 21:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:38 nativespace-cdp sudo[1187491]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 21:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:41 nativespace-cdp sudo[1187497]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:41 nativespace-cdp sudo[1187512]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:41 nativespace-cdp sudo[1187517]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:42 nativespace-cdp sudo[1187521]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:42 nativespace-cdp sudo[1187527]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:42 nativespace-cdp sudo[1187533]: pam_unix(sudo:session): session closed for user root
Sep 12 21:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 21:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:09:42 nativespace-cdp sudo[1187538]: pam_unix(sudo:session): session closed for user root
Sep 12 21:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:10:11 nativespace-cdp sudo[1187726]: pam_unix(sudo:session): session closed for user root
Sep 12 21:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 21:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:10:12 nativespace-cdp sudo[1187731]: pam_unix(sudo:session): session closed for user root
Sep 12 21:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=stephani user-2=leereyn1 user-3=agproduc user-4=still user-5=spectrum user-6=hodgesonweb user-7=theblack user-8=jarvisin user-9=ulsukarm user-10=vantagep user-11=athenare user-12=connect9 user-13=lbscrmod user-14=maflemin user-15=foundation user-16=booff user-17=markward user-18=magichat user-19=hhdugcor user-20=lbhyisi user-21=dickemery123 user-22=ptkxhsbt user-23=martsblo user-24=megacards user-25=musorguk user-26=wilsonsw user-27=strathar user-28=atestord user-29=sarafoundation user-30=brmrjxl user-31=lakesan1 user-32=connectedshoppin user-33=thqkgnbz user-34=accooper user-35=ianrayne user-36=putterfi user-37=hubmaster user-38=fetch user-39=carsinyo user-40=gilpin user-41=milloyco user-42=elecleis user-43=firstred user-44=highlegh user-45=southlon user-46=clarkass user-47=firstrel
Sep 12 21:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=costestimatorco user-49=coursemc user-50=opaiscyx user-51=ultbcrra user-52=seftvta user-53=jonhartl user-54=firstres user-55=nativene user-56=innovat1 user-57=stuartge user-58=askhform user-59=alexadmin user-60=skyfirec user-61=newstoda user-62=ggaaorgu user-63=belle user-64=bemadonn user-65=bedfords user-66=vivienn1 user-67=firstre2 user-68=oneoarco user-69=battlere user-70=nstriton user-71=brighto1 user-72=dhyana user-73=beauty user-74=darkstar user-75=eatspam user-76=nsceres user-77=fawcettd user-78=burydropin user-79=steve user-80=bwppodcast user-81=zebrapho user-82=asandcoc user-83=sibtoncc user-84=eugincou user-85=courseme user-86=hirefootballgame user-87=cwsocial user-88=paulmca1 user-89=howardon user-90=pugwash user-91=cathski user-92=cambria1 user-93=reliable user-94=ninejimm user-95=nomistakes user-96=hidden user-97=tigerlet user-98=barbersh user-99=smrszyqg user-100=isleofwi user-101=lkpier
Sep 12 21:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=firstre5 user-103=steakbridieme user-104=donnychicago user-105=ctedorgu user-106=philmcph user-107=nscdp user-108=putterfc user-109=leftie user-110=foods user-111=fortunaz user-112=health2045 user-113=romaldki user-114=ranxterc user-115=hodgsonmail user-116=outdoorc user-117=branko user-118=onlycont user-119=lucy user-120=attlebor user-121=david user-122=careers user-123=nbhavers user-124=chrisdal user-125=mcdermos user-126=jennimil user-127=tomandle user-128=design user-129=stagingerris user-130=dancinggardener user-131=ladburyp user-132=kategilpin user-133=havantho user-134=sketchy user-135=cath user-136=nvihkvu user-137=tstardom user-138=oubpgvbx user-139=what user-140=bakery user-141=crrtipdl user-142=sosevalu user-143=boldover user-144=nove feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 21:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 21:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:10:13 nativespace-cdp sudo[1187736]: pam_unix(sudo:session): session closed for user root
Sep 12 21:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 21:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:10:13 nativespace-cdp sudo[1187741]: pam_unix(sudo:session): session closed for user root
Sep 12 21:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qVuWy49h7P1LiQd8.~
Sep 12 21:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:10:14 nativespace-cdp sudo[1187744]: pam_unix(sudo:session): session closed for user root
Sep 12 21:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qVuWy49h7P1LiQd8.~'
Sep 12 21:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:10:14 nativespace-cdp sudo[1187747]: pam_unix(sudo:session): session closed for user root
Sep 12 21:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qVuWy49h7P1LiQd8.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 21:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:10:14 nativespace-cdp sudo[1187751]: pam_unix(sudo:session): session closed for user root
Sep 12 21:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 21:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:10:14 nativespace-cdp sudo[1187754]: pam_unix(sudo:session): session closed for user root
Sep 12 21:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 21:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:10:21 nativespace-cdp sudo[1187804]: pam_unix(sudo:session): session closed for user root
Sep 12 21:11:34 nativespace-cdp sshd[1188130]: Connection closed by 159.100.136.21 port 58314 [preauth]
Sep 12 21:16:33 nativespace-cdp sshd[1189387]: Connection closed by 159.100.136.21 port 39392 [preauth]
Sep 12 21:21:35 nativespace-cdp sshd[1190862]: Connection closed by 159.100.136.21 port 47996 [preauth]
Sep 12 21:26:34 nativespace-cdp sshd[1192182]: Connection closed by 159.100.136.21 port 57728 [preauth]
Sep 12 21:31:34 nativespace-cdp sshd[1193507]: Connection closed by 159.100.136.21 port 38628 [preauth]
Sep 12 21:36:36 nativespace-cdp sshd[1194749]: Connection closed by 159.100.136.21 port 48358 [preauth]
Sep 12 21:41:35 nativespace-cdp sshd[1196475]: Connection closed by 159.100.136.21 port 55992 [preauth]
Sep 12 21:46:33 nativespace-cdp sshd[1197657]: Connection closed by 159.100.136.21 port 36094 [preauth]
Sep 12 21:47:35 nativespace-cdp sshd[1197815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.141.120.242  user=root
Sep 12 21:47:35 nativespace-cdp sshd[1197815]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 21:47:37 nativespace-cdp sshd[1197815]: Failed password for root from 94.141.120.242 port 43774 ssh2
Sep 12 21:47:40 nativespace-cdp sshd[1197815]: Connection closed by 94.141.120.242 port 43774 [preauth]
Sep 12 21:51:33 nativespace-cdp sshd[1198847]: Connection closed by 159.100.136.21 port 44064 [preauth]
Sep 12 21:54:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:54:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:55:32 nativespace-cdp sudo[1199644]: pam_unix(sudo:session): session closed for user root
Sep 12 21:55:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status clarkass
Sep 12 21:55:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:55:59 nativespace-cdp sudo[1199824]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:56:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:26 nativespace-cdp sudo[1200229]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status clarkass
Sep 12 21:56:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:27 nativespace-cdp sudo[1200242]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:56:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:29 nativespace-cdp sudo[1200287]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status clarkass
Sep 12 21:56:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:29 nativespace-cdp sudo[1200295]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:56:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:34 nativespace-cdp sudo[1200335]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status clarkass
Sep 12 21:56:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:34 nativespace-cdp sudo[1200339]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:37 nativespace-cdp sshd[1200353]: Connection closed by 159.100.136.21 port 52492 [preauth]
Sep 12 21:56:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:56:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:40 nativespace-cdp sudo[1200407]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:56:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:41 nativespace-cdp sudo[1200414]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:56:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:43 nativespace-cdp sudo[1200475]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:56:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:44 nativespace-cdp sudo[1200479]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:56:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:46 nativespace-cdp sudo[1200494]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:56:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:46 nativespace-cdp sudo[1200499]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:56:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:50 nativespace-cdp sudo[1200551]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:56:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:51 nativespace-cdp sudo[1200555]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:56:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:55 nativespace-cdp sudo[1200586]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:56:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:55 nativespace-cdp sudo[1200590]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:56:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:56 nativespace-cdp sudo[1200605]: pam_unix(sudo:session): session closed for user root
Sep 12 21:56:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:56:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:56:57 nativespace-cdp sudo[1200610]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:01 nativespace-cdp sudo[1200656]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:02 nativespace-cdp sudo[1200663]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:03 nativespace-cdp sudo[1200683]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:04 nativespace-cdp sudo[1200687]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:05 nativespace-cdp sudo[1200703]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:06 nativespace-cdp sudo[1200707]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:07 nativespace-cdp sudo[1200726]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:08 nativespace-cdp sudo[1200730]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:09 nativespace-cdp sudo[1200746]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:10 nativespace-cdp sudo[1200750]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:11 nativespace-cdp sudo[1200766]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:12 nativespace-cdp sudo[1200771]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:13 nativespace-cdp sudo[1200790]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:14 nativespace-cdp sudo[1200795]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:19 nativespace-cdp sudo[1200815]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:19 nativespace-cdp sudo[1200821]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:21 nativespace-cdp sudo[1200837]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:22 nativespace-cdp sudo[1200841]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:23 nativespace-cdp sudo[1200858]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:24 nativespace-cdp sudo[1200864]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:28 nativespace-cdp sudo[1200946]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:29 nativespace-cdp sudo[1200950]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:33 nativespace-cdp sudo[1200975]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:34 nativespace-cdp sudo[1201024]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:36 nativespace-cdp sudo[1201041]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:37 nativespace-cdp sudo[1201046]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:38 nativespace-cdp sudo[1201075]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:39 nativespace-cdp sudo[1201082]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:40 nativespace-cdp sudo[1201100]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:41 nativespace-cdp sudo[1201104]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:46 nativespace-cdp sudo[1201144]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:46 nativespace-cdp sudo[1201149]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:48 nativespace-cdp sudo[1201166]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:48 nativespace-cdp sudo[1201170]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:50 nativespace-cdp sudo[1201190]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:50 nativespace-cdp sudo[1201194]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 21:57:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:52 nativespace-cdp sudo[1201213]: pam_unix(sudo:session): session closed for user root
Sep 12 21:57:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 21:57:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 21:57:52 nativespace-cdp sudo[1201217]: pam_unix(sudo:session): session closed for user root
Sep 12 22:01:33 nativespace-cdp sshd[1202755]: Connection closed by 159.100.136.21 port 33098 [preauth]
Sep 12 22:06:34 nativespace-cdp sshd[1204219]: Connection closed by 159.100.136.21 port 42930 [preauth]
Sep 12 22:07:04 nativespace-cdp sshd[1204319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.141.120.242  user=root
Sep 12 22:07:04 nativespace-cdp sshd[1204319]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 22:07:05 nativespace-cdp sshd[1204319]: Failed password for root from 94.141.120.242 port 44148 ssh2
Sep 12 22:07:06 nativespace-cdp sshd[1204319]: Connection closed by 94.141.120.242 port 44148 [preauth]
Sep 12 22:08:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 22:08:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:08:07 nativespace-cdp sudo[1204579]: pam_unix(sudo:session): session closed for user root
Sep 12 22:08:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 22:08:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:08:07 nativespace-cdp sudo[1204584]: pam_unix(sudo:session): session closed for user root
Sep 12 22:08:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 22:08:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:08:10 nativespace-cdp sudo[1204600]: pam_unix(sudo:session): session closed for user root
Sep 12 22:08:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 22:08:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:08:10 nativespace-cdp sudo[1204605]: pam_unix(sudo:session): session closed for user root
Sep 12 22:08:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 22:08:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:08:13 nativespace-cdp sudo[1204623]: pam_unix(sudo:session): session closed for user root
Sep 12 22:08:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 22:08:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:08:14 nativespace-cdp sudo[1204629]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 22:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:30 nativespace-cdp sudo[1204913]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 22:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:30 nativespace-cdp sudo[1204917]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 22:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:31 nativespace-cdp sudo[1204922]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 22:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:31 nativespace-cdp sudo[1204928]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 22:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:34 nativespace-cdp sudo[1204934]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:34 nativespace-cdp sudo[1204951]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:34 nativespace-cdp sudo[1204956]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:34 nativespace-cdp sudo[1204960]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:34 nativespace-cdp sudo[1204965]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:34 nativespace-cdp sudo[1204971]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 22:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:34 nativespace-cdp sudo[1204976]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 22:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:36 nativespace-cdp sudo[1204988]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 22:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:36 nativespace-cdp sudo[1204995]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=lbscrmod user-3=maflemin user-4=vantagep user-5=connect9 user-6=athenare user-7=foundation user-8=booff user-9=markward user-10=leereyn1 user-11=stephani user-12=agproduc user-13=still user-14=hodgesonweb user-15=theblack user-16=spectrum user-17=jarvisin user-18=megacards user-19=musorguk user-20=wilsonsw user-21=atestord user-22=sarafoundation user-23=strathar user-24=brmrjxl user-25=lakesan1 user-26=magichat user-27=hhdugcor user-28=lbhyisi user-29=ptkxhsbt user-30=dickemery123 user-31=martsblo user-32=highlegh user-33=southlon user-34=firstred user-35=costestimatorco user-36=firstrel user-37=clarkass user-38=opaiscyx user-39=coursemc user-40=firstres user-41=ultbcrra user-42=jonhartl user-43=seftvta user-44=thqkgnbz user-45=connectedshoppin user-46=ianrayne user-47=accooper
Sep 12 22:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=fetch user-49=carsinyo user-50=hubmaster user-51=putterfi user-52=elecleis user-53=gilpin user-54=milloyco user-55=bemadonn user-56=newstoda user-57=belle user-58=ggaaorgu user-59=bedfords user-60=oneoarco user-61=battlere user-62=vivienn1 user-63=firstre2 user-64=nstriton user-65=brighto1 user-66=nativene user-67=askhform user-68=stuartge user-69=innovat1 user-70=skyfirec user-71=alexadmin user-72=steve user-73=zebrapho user-74=bwppodcast user-75=sibtoncc user-76=asandcoc user-77=dhyana user-78=darkstar user-79=eatspam user-80=beauty user-81=nsceres user-82=fawcettd user-83=burydropin user-84=tigerlet user-85=barbersh user-86=nomistakes user-87=hidden user-88=isleofwi user-89=smrszyqg user-90=firstre5 user-91=donnychicago user-92=steakbridieme user-93=philmcph user-94=ctedorgu user-95=lkpier user-96=leftie user-97=foods user-98=health2045 user-99=fortunaz user-100=nscdp user-101=putterfc
Sep 12 22:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=courseme user-103=eugincou user-104=hirefootballgame user-105=cwsocial user-106=paulmca1 user-107=pugwash user-108=howardon user-109=reliable user-110=ninejimm user-111=cambria1 user-112=cathski user-113=david user-114=nbhavers user-115=careers user-116=mcdermos user-117=chrisdal user-118=jennimil user-119=tomandle user-120=romaldki user-121=branko user-122=hodgsonmail user-123=outdoorc user-124=ranxterc user-125=onlycont user-126=lucy user-127=attlebor user-128=crrtipdl user-129=sosevalu user-130=bakery user-131=boldover user-132=nove user-133=design user-134=kategilpin user-135=stagingerris user-136=dancinggardener user-137=ladburyp user-138=nvihkvu user-139=havantho user-140=cath user-141=sketchy user-142=what user-143=oubpgvbx user-144=tstardom feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 22:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 22:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:37 nativespace-cdp sudo[1205003]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:38 nativespace-cdp sudo[1205071]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nKruqTTxvHfgoody.~
Sep 12 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:38 nativespace-cdp sudo[1205077]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nKruqTTxvHfgoody.~'
Sep 12 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:38 nativespace-cdp sudo[1205081]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nKruqTTxvHfgoody.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:38 nativespace-cdp sudo[1205087]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:38 nativespace-cdp sudo[1205092]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep 12 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:39 nativespace-cdp sudo[1205099]: pam_unix(sudo:session): session closed for user root
Sep 12 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:09:51 nativespace-cdp sudo[1205259]: pam_unix(sudo:session): session closed for user root
Sep 12 22:11:33 nativespace-cdp sshd[1205995]: Connection closed by 159.100.136.21 port 52200 [preauth]
Sep 12 22:16:33 nativespace-cdp sshd[1207317]: Connection closed by 159.100.136.21 port 60218 [preauth]
Sep 12 22:20:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 22:20:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:20:03 nativespace-cdp sudo[1208124]: pam_unix(sudo:session): session closed for user root
Sep 12 22:20:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 12 22:20:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:20:04 nativespace-cdp sudo[1208129]: pam_unix(sudo:session): session closed for user root
Sep 12 22:20:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep 12 22:20:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 22:20:06 nativespace-cdp sudo[1208137]: pam_unix(sudo:session): session closed for user root
Sep 12 22:21:33 nativespace-cdp sshd[1208703]: Connection closed by 159.100.136.21 port 40868 [preauth]
Sep 12 22:25:49 nativespace-cdp sshd[1209780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.141.120.242  user=root
Sep 12 22:25:49 nativespace-cdp sshd[1209780]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 12 22:25:52 nativespace-cdp sshd[1209780]: Failed password for root from 94.141.120.242 port 52266 ssh2
Sep 12 22:26:33 nativespace-cdp sshd[1210088]: Connection closed by 159.100.136.21 port 50400 [preauth]
Sep 12 22:31:35 nativespace-cdp sshd[1211607]: Connection closed by 159.100.136.21 port 59684 [preauth]
Sep 12 22:36:33 nativespace-cdp sshd[1212702]: Connection closed by 159.100.136.21 port 40632 [preauth]
Sep 12 22:41:36 nativespace-cdp sshd[1214111]: Connection closed by 159.100.136.21 port 49250 [preauth]
Sep 12 22:46:33 nativespace-cdp sshd[1215490]: Connection closed by 159.100.136.21 port 59074 [preauth]
Sep 12 22:51:34 nativespace-cdp sshd[1216722]: Connection closed by 159.100.136.21 port 40052 [preauth]
Sep 12 22:55:17 nativespace-cdp sshd[1217460]: Invalid user admin from 181.28.101.14 port 38138
Sep 12 22:55:17 nativespace-cdp sshd[1217460]: input_userauth_request: invalid user admin [preauth]
Sep 12 22:55:17 nativespace-cdp sshd[1217460]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 22:55:17 nativespace-cdp sshd[1217460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.28.101.14
Sep 12 22:55:19 nativespace-cdp sshd[1217460]: Failed password for invalid user admin from 181.28.101.14 port 38138 ssh2
Sep 12 22:55:24 nativespace-cdp sshd[1217460]: Received disconnect from 181.28.101.14 port 38138:11: Bye Bye [preauth]
Sep 12 22:55:24 nativespace-cdp sshd[1217460]: Disconnected from 181.28.101.14 port 38138 [preauth]
Sep 12 22:56:13 nativespace-cdp sshd[1217692]: Invalid user developer from 41.223.40.78 port 44426
Sep 12 22:56:13 nativespace-cdp sshd[1217692]: input_userauth_request: invalid user developer [preauth]
Sep 12 22:56:13 nativespace-cdp sshd[1217692]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 22:56:13 nativespace-cdp sshd[1217692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.223.40.78
Sep 12 22:56:16 nativespace-cdp sshd[1217692]: Failed password for invalid user developer from 41.223.40.78 port 44426 ssh2
Sep 12 22:56:16 nativespace-cdp sshd[1217692]: Received disconnect from 41.223.40.78 port 44426:11: Bye Bye [preauth]
Sep 12 22:56:16 nativespace-cdp sshd[1217692]: Disconnected from 41.223.40.78 port 44426 [preauth]
Sep 12 22:56:33 nativespace-cdp sshd[1217817]: Connection closed by 159.100.136.21 port 49574 [preauth]
Sep 12 22:58:46 nativespace-cdp sshd[1218535]: Invalid user user from 152.228.164.249 port 46528
Sep 12 22:58:46 nativespace-cdp sshd[1218535]: input_userauth_request: invalid user user [preauth]
Sep 12 22:58:46 nativespace-cdp sshd[1218535]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 22:58:46 nativespace-cdp sshd[1218535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.228.164.249
Sep 12 22:58:47 nativespace-cdp sshd[1218535]: Failed password for invalid user user from 152.228.164.249 port 46528 ssh2
Sep 12 22:58:47 nativespace-cdp sshd[1218535]: Received disconnect from 152.228.164.249 port 46528:11: Bye Bye [preauth]
Sep 12 22:58:47 nativespace-cdp sshd[1218535]: Disconnected from 152.228.164.249 port 46528 [preauth]
Sep 12 23:01:34 nativespace-cdp sshd[1219460]: Connection closed by 159.100.136.21 port 58944 [preauth]
Sep 12 23:03:14 nativespace-cdp sshd[1219750]: Invalid user deploy from 181.28.101.14 port 44040
Sep 12 23:03:14 nativespace-cdp sshd[1219750]: input_userauth_request: invalid user deploy [preauth]
Sep 12 23:03:14 nativespace-cdp sshd[1219750]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:03:14 nativespace-cdp sshd[1219750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.28.101.14
Sep 12 23:03:15 nativespace-cdp sshd[1219761]: Invalid user deploy from 152.228.164.249 port 55992
Sep 12 23:03:15 nativespace-cdp sshd[1219761]: input_userauth_request: invalid user deploy [preauth]
Sep 12 23:03:15 nativespace-cdp sshd[1219761]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:03:15 nativespace-cdp sshd[1219761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.228.164.249
Sep 12 23:03:16 nativespace-cdp sshd[1219750]: Failed password for invalid user deploy from 181.28.101.14 port 44040 ssh2
Sep 12 23:03:16 nativespace-cdp sshd[1219750]: Received disconnect from 181.28.101.14 port 44040:11: Bye Bye [preauth]
Sep 12 23:03:16 nativespace-cdp sshd[1219750]: Disconnected from 181.28.101.14 port 44040 [preauth]
Sep 12 23:03:17 nativespace-cdp sshd[1219761]: Failed password for invalid user deploy from 152.228.164.249 port 55992 ssh2
Sep 12 23:03:19 nativespace-cdp sshd[1219761]: Received disconnect from 152.228.164.249 port 55992:11: Bye Bye [preauth]
Sep 12 23:03:19 nativespace-cdp sshd[1219761]: Disconnected from 152.228.164.249 port 55992 [preauth]
Sep 12 23:03:53 nativespace-cdp sshd[1219847]: Invalid user username from 41.223.40.78 port 50320
Sep 12 23:03:53 nativespace-cdp sshd[1219847]: input_userauth_request: invalid user username [preauth]
Sep 12 23:03:53 nativespace-cdp sshd[1219847]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:03:53 nativespace-cdp sshd[1219847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.223.40.78
Sep 12 23:03:53 nativespace-cdp sshd[1219853]: Invalid user user2 from 152.228.164.249 port 35962
Sep 12 23:03:53 nativespace-cdp sshd[1219853]: input_userauth_request: invalid user user2 [preauth]
Sep 12 23:03:53 nativespace-cdp sshd[1219853]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:03:53 nativespace-cdp sshd[1219853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.228.164.249
Sep 12 23:03:55 nativespace-cdp sshd[1219847]: Failed password for invalid user username from 41.223.40.78 port 50320 ssh2
Sep 12 23:03:55 nativespace-cdp sshd[1219853]: Failed password for invalid user user2 from 152.228.164.249 port 35962 ssh2
Sep 12 23:03:55 nativespace-cdp sshd[1219853]: Received disconnect from 152.228.164.249 port 35962:11: Bye Bye [preauth]
Sep 12 23:03:55 nativespace-cdp sshd[1219853]: Disconnected from 152.228.164.249 port 35962 [preauth]
Sep 12 23:03:55 nativespace-cdp sshd[1219847]: Received disconnect from 41.223.40.78 port 50320:11: Bye Bye [preauth]
Sep 12 23:03:55 nativespace-cdp sshd[1219847]: Disconnected from 41.223.40.78 port 50320 [preauth]
Sep 12 23:04:12 nativespace-cdp sshd[1219928]: Invalid user ubuntu from 181.28.101.14 port 54988
Sep 12 23:04:12 nativespace-cdp sshd[1219928]: input_userauth_request: invalid user ubuntu [preauth]
Sep 12 23:04:12 nativespace-cdp sshd[1219928]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:04:12 nativespace-cdp sshd[1219928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.28.101.14
Sep 12 23:04:13 nativespace-cdp sshd[1219928]: Failed password for invalid user ubuntu from 181.28.101.14 port 54988 ssh2
Sep 12 23:04:13 nativespace-cdp sshd[1219928]: Received disconnect from 181.28.101.14 port 54988:11: Bye Bye [preauth]
Sep 12 23:04:13 nativespace-cdp sshd[1219928]: Disconnected from 181.28.101.14 port 54988 [preauth]
Sep 12 23:04:46 nativespace-cdp sshd[1220058]: Invalid user admin from 41.223.40.78 port 53278
Sep 12 23:04:46 nativespace-cdp sshd[1220058]: input_userauth_request: invalid user admin [preauth]
Sep 12 23:04:46 nativespace-cdp sshd[1220058]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:04:46 nativespace-cdp sshd[1220058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.223.40.78
Sep 12 23:04:49 nativespace-cdp sshd[1220058]: Failed password for invalid user admin from 41.223.40.78 port 53278 ssh2
Sep 12 23:06:35 nativespace-cdp sshd[1220679]: Connection closed by 159.100.136.21 port 38474 [preauth]
Sep 12 23:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 12 23:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:30 nativespace-cdp sudo[1221245]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 12 23:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:30 nativespace-cdp sudo[1221250]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 12 23:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:31 nativespace-cdp sudo[1221255]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 12 23:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:31 nativespace-cdp sudo[1221262]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 12 23:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:33 nativespace-cdp sudo[1221268]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 12 23:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:33 nativespace-cdp sudo[1221284]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 12 23:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:33 nativespace-cdp sudo[1221289]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 12 23:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:33 nativespace-cdp sudo[1221293]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 12 23:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:33 nativespace-cdp sudo[1221297]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 12 23:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:33 nativespace-cdp sudo[1221303]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 12 23:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:33 nativespace-cdp sudo[1221309]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 12 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:41 nativespace-cdp sudo[1221344]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 12 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:41 nativespace-cdp sudo[1221350]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lucy user-2=attlebor user-3=onlycont user-4=branko user-5=hodgsonmail user-6=outdoorc user-7=ranxterc user-8=romaldki user-9=tomandle user-10=jennimil user-11=mcdermos user-12=chrisdal user-13=david user-14=careers user-15=nbhavers user-16=what user-17=tstardom user-18=oubpgvbx user-19=nvihkvu user-20=havantho user-21=sketchy user-22=cath user-23=kategilpin user-24=dancinggardener user-25=stagingerris user-26=ladburyp user-27=design user-28=nove user-29=boldover user-30=crrtipdl user-31=sosevalu user-32=bakery user-33=fawcettd user-34=burydropin user-35=nsceres user-36=darkstar user-37=eatspam user-38=beauty user-39=dhyana user-40=asandcoc user-41=sibtoncc user-42=zebrapho user-43=bwppodcast user-44=steve user-45=reliable user-46=ninejimm user-47=cambria1 user-48=cathski user-49=cwsocial
Sep 12 23:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=pugwash user-51=howardon user-52=paulmca1 user-53=hirefootballgame user-54=courseme user-55=eugincou user-56=foods user-57=leftie user-58=fortunaz user-59=health2045 user-60=nscdp user-61=putterfc user-62=firstre5 user-63=donnychicago user-64=steakbridieme user-65=ctedorgu user-66=philmcph user-67=lkpier user-68=smrszyqg user-69=isleofwi user-70=tigerlet user-71=barbersh user-72=nomistakes user-73=hidden user-74=elecleis user-75=gilpin user-76=milloyco user-77=fetch user-78=carsinyo user-79=putterfi user-80=hubmaster user-81=ianrayne user-82=accooper user-83=thqkgnbz user-84=connectedshoppin user-85=firstres user-86=ultbcrra user-87=jonhartl user-88=seftvta user-89=coursemc user-90=opaiscyx user-91=costestimatorco user-92=firstrel user-93=clarkass user-94=highlegh user-95=southlon user-96=firstred user-97=skyfirec user-98=alexadmin user-99=stuartge user-100=askhform user-101=innovat1 user-102=nativene
Sep 12 23:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=nstriton user-104=brighto1 user-105=oneoarco user-106=battlere user-107=vivienn1 user-108=firstre2 user-109=bedfords user-110=bemadonn user-111=newstoda user-112=belle user-113=ggaaorgu user-114=jarvisin user-115=theblack user-116=hodgesonweb user-117=spectrum user-118=agproduc user-119=still user-120=leereyn1 user-121=stephani user-122=foundation user-123=booff user-124=markward user-125=lbscrmod user-126=maflemin user-127=vantagep user-128=athenare user-129=connect9 user-130=ulsukarm user-131=martsblo user-132=ptkxhsbt user-133=dickemery123 user-134=hhdugcor user-135=lbhyisi user-136=magichat user-137=lakesan1 user-138=brmrjxl user-139=atestord user-140=sarafoundation user-141=strathar user-142=wilsonsw user-143=megacards user-144=musorguk feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 12 23:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 12 23:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:42 nativespace-cdp sudo[1221357]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:42 nativespace-cdp sudo[1221371]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EuOWGBijVWQ60oZj.~
Sep 12 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:42 nativespace-cdp sudo[1221376]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EuOWGBijVWQ60oZj.~'
Sep 12 23:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:42 nativespace-cdp sudo[1221380]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EuOWGBijVWQ60oZj.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 12 23:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:43 nativespace-cdp sudo[1221386]: pam_unix(sudo:session): session closed for user root
Sep 12 23:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 12 23:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:09:43 nativespace-cdp sudo[1221391]: pam_unix(sudo:session): session closed for user root
Sep 12 23:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 12 23:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 12 23:10:06 nativespace-cdp sudo[1221602]: pam_unix(sudo:session): session closed for user root
Sep 12 23:11:36 nativespace-cdp sshd[1222087]: Connection closed by 159.100.136.21 port 47810 [preauth]
Sep 12 23:16:33 nativespace-cdp sshd[1223355]: Connection closed by 159.100.136.21 port 56254 [preauth]
Sep 12 23:18:33 nativespace-cdp sshd[1223920]: Invalid user dev from 159.203.161.10 port 35864
Sep 12 23:18:33 nativespace-cdp sshd[1223920]: input_userauth_request: invalid user dev [preauth]
Sep 12 23:18:33 nativespace-cdp sshd[1223920]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:18:33 nativespace-cdp sshd[1223920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.161.10
Sep 12 23:18:35 nativespace-cdp sshd[1223920]: Failed password for invalid user dev from 159.203.161.10 port 35864 ssh2
Sep 12 23:18:35 nativespace-cdp sshd[1223920]: Received disconnect from 159.203.161.10 port 35864:11: Bye Bye [preauth]
Sep 12 23:18:35 nativespace-cdp sshd[1223920]: Disconnected from 159.203.161.10 port 35864 [preauth]
Sep 12 23:21:36 nativespace-cdp sshd[1224676]: Connection closed by 159.100.136.21 port 36152 [preauth]
Sep 12 23:25:54 nativespace-cdp sshd[1225596]: Invalid user oracle from 119.246.15.94 port 40777
Sep 12 23:25:54 nativespace-cdp sshd[1225596]: input_userauth_request: invalid user oracle [preauth]
Sep 12 23:25:54 nativespace-cdp sshd[1225596]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:25:54 nativespace-cdp sshd[1225596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.246.15.94
Sep 12 23:25:56 nativespace-cdp sshd[1225596]: Failed password for invalid user oracle from 119.246.15.94 port 40777 ssh2
Sep 12 23:26:04 nativespace-cdp sshd[1225596]: Received disconnect from 119.246.15.94 port 40777:11: Bye Bye [preauth]
Sep 12 23:26:04 nativespace-cdp sshd[1225596]: Disconnected from 119.246.15.94 port 40777 [preauth]
Sep 12 23:26:28 nativespace-cdp sshd[1225837]: Invalid user user from 159.203.161.10 port 47600
Sep 12 23:26:28 nativespace-cdp sshd[1225837]: input_userauth_request: invalid user user [preauth]
Sep 12 23:26:28 nativespace-cdp sshd[1225837]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:26:28 nativespace-cdp sshd[1225837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.161.10
Sep 12 23:26:30 nativespace-cdp sshd[1225837]: Failed password for invalid user user from 159.203.161.10 port 47600 ssh2
Sep 12 23:26:30 nativespace-cdp sshd[1225837]: Received disconnect from 159.203.161.10 port 47600:11: Bye Bye [preauth]
Sep 12 23:26:30 nativespace-cdp sshd[1225837]: Disconnected from 159.203.161.10 port 47600 [preauth]
Sep 12 23:26:35 nativespace-cdp sshd[1225855]: Connection closed by 159.100.136.21 port 45410 [preauth]
Sep 12 23:27:30 nativespace-cdp sshd[1226106]: Invalid user user from 159.203.161.10 port 38992
Sep 12 23:27:30 nativespace-cdp sshd[1226106]: input_userauth_request: invalid user user [preauth]
Sep 12 23:27:30 nativespace-cdp sshd[1226106]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:27:30 nativespace-cdp sshd[1226106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.161.10
Sep 12 23:27:32 nativespace-cdp sshd[1226106]: Failed password for invalid user user from 159.203.161.10 port 38992 ssh2
Sep 12 23:27:37 nativespace-cdp sshd[1226106]: Received disconnect from 159.203.161.10 port 38992:11: Bye Bye [preauth]
Sep 12 23:27:37 nativespace-cdp sshd[1226106]: Disconnected from 159.203.161.10 port 38992 [preauth]
Sep 12 23:31:33 nativespace-cdp sshd[1227287]: Connection closed by 159.100.136.21 port 54070 [preauth]
Sep 12 23:33:25 nativespace-cdp sshd[1227576]: Invalid user oracle from 119.246.15.94 port 44490
Sep 12 23:33:25 nativespace-cdp sshd[1227576]: input_userauth_request: invalid user oracle [preauth]
Sep 12 23:33:25 nativespace-cdp sshd[1227576]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:33:25 nativespace-cdp sshd[1227576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.246.15.94
Sep 12 23:33:27 nativespace-cdp sshd[1227576]: Failed password for invalid user oracle from 119.246.15.94 port 44490 ssh2
Sep 12 23:33:29 nativespace-cdp sshd[1227576]: Received disconnect from 119.246.15.94 port 44490:11: Bye Bye [preauth]
Sep 12 23:33:29 nativespace-cdp sshd[1227576]: Disconnected from 119.246.15.94 port 44490 [preauth]
Sep 12 23:34:49 nativespace-cdp sshd[1227820]: Invalid user diradmin from 119.246.15.94 port 58601
Sep 12 23:34:49 nativespace-cdp sshd[1227820]: input_userauth_request: invalid user diradmin [preauth]
Sep 12 23:34:49 nativespace-cdp sshd[1227820]: pam_unix(sshd:auth): check pass; user unknown
Sep 12 23:34:49 nativespace-cdp sshd[1227820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.246.15.94
Sep 12 23:34:51 nativespace-cdp sshd[1227820]: Failed password for invalid user diradmin from 119.246.15.94 port 58601 ssh2
Sep 12 23:36:33 nativespace-cdp sshd[1228403]: Connection closed by 159.100.136.21 port 35802 [preauth]
Sep 12 23:41:33 nativespace-cdp sshd[1229715]: Connection closed by 159.100.136.21 port 43790 [preauth]
Sep 12 23:46:35 nativespace-cdp sshd[1230802]: Connection closed by 159.100.136.21 port 52600 [preauth]
Sep 12 23:51:33 nativespace-cdp sshd[1232132]: Connection closed by 159.100.136.21 port 60488 [preauth]
Sep 12 23:56:33 nativespace-cdp sshd[1233566]: Connection closed by 159.100.136.21 port 41356 [preauth]
Sep 13 00:01:33 nativespace-cdp sshd[1235000]: Connection closed by 159.100.136.21 port 50030 [preauth]
Sep 13 00:06:38 nativespace-cdp sshd[1236015]: Connection closed by 159.100.136.21 port 59822 [preauth]
Sep 13 00:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 00:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:31 nativespace-cdp sudo[1236537]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 00:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:31 nativespace-cdp sudo[1236541]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 00:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:31 nativespace-cdp sudo[1236547]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 00:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:31 nativespace-cdp sudo[1236554]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 00:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:34 nativespace-cdp sudo[1236560]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:34 nativespace-cdp sudo[1236570]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:34 nativespace-cdp sudo[1236576]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:34 nativespace-cdp sudo[1236580]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:34 nativespace-cdp sudo[1236585]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:34 nativespace-cdp sudo[1236591]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 00:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:34 nativespace-cdp sudo[1236596]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 00:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:41 nativespace-cdp sudo[1236628]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 00:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:41 nativespace-cdp sudo[1236634]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=zebrapho user-2=bwppodcast user-3=steve user-4=asandcoc user-5=sibtoncc user-6=darkstar user-7=eatspam user-8=beauty user-9=dhyana user-10=fawcettd user-11=burydropin user-12=nsceres user-13=isleofwi user-14=smrszyqg user-15=tigerlet user-16=barbersh user-17=nomistakes user-18=hidden user-19=foods user-20=leftie user-21=health2045 user-22=fortunaz user-23=nscdp user-24=putterfc user-25=firstre5 user-26=steakbridieme user-27=donnychicago user-28=ctedorgu user-29=philmcph user-30=lkpier user-31=hirefootballgame user-32=courseme user-33=eugincou user-34=ninejimm user-35=reliable user-36=cathski user-37=cambria1 user-38=cwsocial user-39=howardon user-40=paulmca1 user-41=pugwash user-42=mcdermos user-43=chrisdal user-44=david user-45=nbhavers user-46=careers user-47=tomandle user-48=jennimil
Sep 13 00:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=branko user-50=ranxterc user-51=outdoorc user-52=hodgsonmail user-53=romaldki user-54=lucy user-55=attlebor user-56=onlycont user-57=crrtipdl user-58=sosevalu user-59=bakery user-60=nove user-61=boldover user-62=kategilpin user-63=dancinggardener user-64=stagingerris user-65=ladburyp user-66=design user-67=what user-68=tstardom user-69=oubpgvbx user-70=nvihkvu user-71=havantho user-72=cath user-73=sketchy user-74=ulsukarm user-75=markward user-76=booff user-77=foundation user-78=lbscrmod user-79=maflemin user-80=vantagep user-81=connect9 user-82=athenare user-83=agproduc user-84=still user-85=leereyn1 user-86=stephani user-87=jarvisin user-88=hodgesonweb user-89=theblack user-90=spectrum user-91=wilsonsw user-92=megacards user-93=musorguk user-94=lakesan1 user-95=brmrjxl user-96=atestord user-97=sarafoundation user-98=strathar user-99=hhdugcor user-100=lbhyisi user-101=magichat user-102=martsblo
Sep 13 00:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=ptkxhsbt user-104=dickemery123 user-105=costestimatorco user-106=firstrel user-107=clarkass user-108=highlegh user-109=southlon user-110=firstred user-111=firstres user-112=ultbcrra user-113=jonhartl user-114=seftvta user-115=coursemc user-116=opaiscyx user-117=ianrayne user-118=accooper user-119=thqkgnbz user-120=connectedshoppin user-121=elecleis user-122=milloyco user-123=gilpin user-124=fetch user-125=carsinyo user-126=hubmaster user-127=putterfi user-128=bedfords user-129=bemadonn user-130=newstoda user-131=belle user-132=ggaaorgu user-133=nstriton user-134=brighto1 user-135=oneoarco user-136=battlere user-137=vivienn1 user-138=firstre2 user-139=askhform user-140=stuartge user-141=innovat1 user-142=nativene user-143=skyfirec user-144=alexadmin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 00:09:41 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 00:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:42 nativespace-cdp sudo[1236640]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 00:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:42 nativespace-cdp sudo[1236648]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Kyv7derNc5bz8SGV.~
Sep 13 00:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:43 nativespace-cdp sudo[1236653]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Kyv7derNc5bz8SGV.~'
Sep 13 00:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:43 nativespace-cdp sudo[1236657]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Kyv7derNc5bz8SGV.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 00:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:43 nativespace-cdp sudo[1236663]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 00:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:43 nativespace-cdp sudo[1236668]: pam_unix(sudo:session): session closed for user root
Sep 13 00:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 00:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 00:09:44 nativespace-cdp sudo[1236688]: pam_unix(sudo:session): session closed for user root
Sep 13 00:11:25 nativespace-cdp sshd[1237221]: Invalid user deep from 150.136.129.10 port 48542
Sep 13 00:11:25 nativespace-cdp sshd[1237221]: input_userauth_request: invalid user deep [preauth]
Sep 13 00:11:25 nativespace-cdp sshd[1237221]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:11:25 nativespace-cdp sshd[1237221]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.136.129.10
Sep 13 00:11:27 nativespace-cdp sshd[1237221]: Failed password for invalid user deep from 150.136.129.10 port 48542 ssh2
Sep 13 00:11:28 nativespace-cdp sshd[1237221]: Received disconnect from 150.136.129.10 port 48542:11: Bye Bye [preauth]
Sep 13 00:11:28 nativespace-cdp sshd[1237221]: Disconnected from 150.136.129.10 port 48542 [preauth]
Sep 13 00:11:33 nativespace-cdp sshd[1237238]: Connection closed by 159.100.136.21 port 41012 [preauth]
Sep 13 00:12:54 nativespace-cdp sshd[1237453]: Invalid user andrey from 47.236.155.113 port 43698
Sep 13 00:12:54 nativespace-cdp sshd[1237453]: input_userauth_request: invalid user andrey [preauth]
Sep 13 00:12:54 nativespace-cdp sshd[1237453]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:12:54 nativespace-cdp sshd[1237453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.155.113
Sep 13 00:12:55 nativespace-cdp sshd[1237453]: Failed password for invalid user andrey from 47.236.155.113 port 43698 ssh2
Sep 13 00:12:56 nativespace-cdp sshd[1237453]: Received disconnect from 47.236.155.113 port 43698:11: Bye Bye [preauth]
Sep 13 00:12:56 nativespace-cdp sshd[1237453]: Disconnected from 47.236.155.113 port 43698 [preauth]
Sep 13 00:13:51 nativespace-cdp sshd[1237686]: Invalid user ansible from 159.203.143.4 port 43560
Sep 13 00:13:51 nativespace-cdp sshd[1237686]: input_userauth_request: invalid user ansible [preauth]
Sep 13 00:13:51 nativespace-cdp sshd[1237686]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:13:51 nativespace-cdp sshd[1237686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.143.4
Sep 13 00:13:52 nativespace-cdp sshd[1237688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.136.129.10  user=root
Sep 13 00:13:52 nativespace-cdp sshd[1237688]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 00:13:53 nativespace-cdp sshd[1237690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.155.113  user=root
Sep 13 00:13:53 nativespace-cdp sshd[1237690]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 00:13:53 nativespace-cdp sshd[1237688]: Failed password for root from 150.136.129.10 port 37644 ssh2
Sep 13 00:13:53 nativespace-cdp sshd[1237686]: Failed password for invalid user ansible from 159.203.143.4 port 43560 ssh2
Sep 13 00:13:54 nativespace-cdp sshd[1237688]: Received disconnect from 150.136.129.10 port 37644:11: Bye Bye [preauth]
Sep 13 00:13:54 nativespace-cdp sshd[1237688]: Disconnected from 150.136.129.10 port 37644 [preauth]
Sep 13 00:13:54 nativespace-cdp sshd[1237686]: Received disconnect from 159.203.143.4 port 43560:11: Bye Bye [preauth]
Sep 13 00:13:54 nativespace-cdp sshd[1237686]: Disconnected from 159.203.143.4 port 43560 [preauth]
Sep 13 00:13:54 nativespace-cdp sshd[1237690]: Failed password for root from 47.236.155.113 port 45798 ssh2
Sep 13 00:13:55 nativespace-cdp sshd[1237690]: Received disconnect from 47.236.155.113 port 45798:11: Bye Bye [preauth]
Sep 13 00:13:55 nativespace-cdp sshd[1237690]: Disconnected from 47.236.155.113 port 45798 [preauth]
Sep 13 00:14:19 nativespace-cdp sshd[1237766]: Invalid user rsync from 47.236.155.113 port 34124
Sep 13 00:14:19 nativespace-cdp sshd[1237766]: input_userauth_request: invalid user rsync [preauth]
Sep 13 00:14:19 nativespace-cdp sshd[1237766]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:14:19 nativespace-cdp sshd[1237766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.155.113
Sep 13 00:14:20 nativespace-cdp sshd[1237766]: Failed password for invalid user rsync from 47.236.155.113 port 34124 ssh2
Sep 13 00:14:21 nativespace-cdp sshd[1237766]: Received disconnect from 47.236.155.113 port 34124:11: Bye Bye [preauth]
Sep 13 00:14:21 nativespace-cdp sshd[1237766]: Disconnected from 47.236.155.113 port 34124 [preauth]
Sep 13 00:14:28 nativespace-cdp sshd[1237833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.136.129.10  user=root
Sep 13 00:14:28 nativespace-cdp sshd[1237833]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 00:14:30 nativespace-cdp sshd[1237833]: Failed password for root from 150.136.129.10 port 46520 ssh2
Sep 13 00:14:30 nativespace-cdp sshd[1237833]: Received disconnect from 150.136.129.10 port 46520:11: Bye Bye [preauth]
Sep 13 00:14:30 nativespace-cdp sshd[1237833]: Disconnected from 150.136.129.10 port 46520 [preauth]
Sep 13 00:14:45 nativespace-cdp sshd[1237896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.143.4  user=root
Sep 13 00:14:45 nativespace-cdp sshd[1237896]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 00:14:47 nativespace-cdp sshd[1237896]: Failed password for root from 159.203.143.4 port 41038 ssh2
Sep 13 00:14:47 nativespace-cdp sshd[1237896]: Received disconnect from 159.203.143.4 port 41038:11: Bye Bye [preauth]
Sep 13 00:14:47 nativespace-cdp sshd[1237896]: Disconnected from 159.203.143.4 port 41038 [preauth]
Sep 13 00:15:34 nativespace-cdp sshd[1238231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.143.4  user=root
Sep 13 00:15:34 nativespace-cdp sshd[1238231]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 00:15:35 nativespace-cdp sshd[1238231]: Failed password for root from 159.203.143.4 port 36240 ssh2
Sep 13 00:16:33 nativespace-cdp sshd[1238633]: Connection closed by 159.100.136.21 port 50038 [preauth]
Sep 13 00:21:33 nativespace-cdp sshd[1240020]: Connection closed by 159.100.136.21 port 59274 [preauth]
Sep 13 00:21:42 nativespace-cdp sshd[1240043]: Invalid user user from 45.172.153.100 port 33442
Sep 13 00:21:42 nativespace-cdp sshd[1240043]: input_userauth_request: invalid user user [preauth]
Sep 13 00:21:42 nativespace-cdp sshd[1240043]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:21:42 nativespace-cdp sshd[1240043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.172.153.100
Sep 13 00:21:44 nativespace-cdp sshd[1240043]: Failed password for invalid user user from 45.172.153.100 port 33442 ssh2
Sep 13 00:21:44 nativespace-cdp sshd[1240043]: Received disconnect from 45.172.153.100 port 33442:11: Bye Bye [preauth]
Sep 13 00:21:44 nativespace-cdp sshd[1240043]: Disconnected from 45.172.153.100 port 33442 [preauth]
Sep 13 00:25:37 nativespace-cdp sshd[1240736]: Invalid user mysqladmin from 45.175.157.53 port 60176
Sep 13 00:25:37 nativespace-cdp sshd[1240736]: input_userauth_request: invalid user mysqladmin [preauth]
Sep 13 00:25:37 nativespace-cdp sshd[1240736]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:25:37 nativespace-cdp sshd[1240736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.175.157.53
Sep 13 00:25:38 nativespace-cdp sshd[1240736]: Failed password for invalid user mysqladmin from 45.175.157.53 port 60176 ssh2
Sep 13 00:25:39 nativespace-cdp sshd[1240736]: Received disconnect from 45.175.157.53 port 60176:11: Bye Bye [preauth]
Sep 13 00:25:39 nativespace-cdp sshd[1240736]: Disconnected from 45.175.157.53 port 60176 [preauth]
Sep 13 00:26:10 nativespace-cdp sshd[1240853]: Invalid user hduser from 185.227.154.203 port 58744
Sep 13 00:26:10 nativespace-cdp sshd[1240853]: input_userauth_request: invalid user hduser [preauth]
Sep 13 00:26:10 nativespace-cdp sshd[1240853]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:26:10 nativespace-cdp sshd[1240853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.227.154.203
Sep 13 00:26:12 nativespace-cdp sshd[1240853]: Failed password for invalid user hduser from 185.227.154.203 port 58744 ssh2
Sep 13 00:26:12 nativespace-cdp sshd[1240853]: Received disconnect from 185.227.154.203 port 58744:11: Bye Bye [preauth]
Sep 13 00:26:12 nativespace-cdp sshd[1240853]: Disconnected from 185.227.154.203 port 58744 [preauth]
Sep 13 00:26:33 nativespace-cdp sshd[1241376]: Connection closed by 159.100.136.21 port 40402 [preauth]
Sep 13 00:27:45 nativespace-cdp sshd[1241675]: Invalid user admin from 23.158.56.21 port 43916
Sep 13 00:27:45 nativespace-cdp sshd[1241675]: input_userauth_request: invalid user admin [preauth]
Sep 13 00:27:45 nativespace-cdp sshd[1241675]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:27:45 nativespace-cdp sshd[1241675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.158.56.21
Sep 13 00:27:47 nativespace-cdp sshd[1241675]: Failed password for invalid user admin from 23.158.56.21 port 43916 ssh2
Sep 13 00:27:47 nativespace-cdp sshd[1241675]: Received disconnect from 23.158.56.21 port 43916:11: Bye Bye [preauth]
Sep 13 00:27:47 nativespace-cdp sshd[1241675]: Disconnected from 23.158.56.21 port 43916 [preauth]
Sep 13 00:30:13 nativespace-cdp sshd[1242271]: Invalid user admin from 45.172.153.100 port 38088
Sep 13 00:30:13 nativespace-cdp sshd[1242271]: input_userauth_request: invalid user admin [preauth]
Sep 13 00:30:13 nativespace-cdp sshd[1242271]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:30:13 nativespace-cdp sshd[1242271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.172.153.100
Sep 13 00:30:15 nativespace-cdp sshd[1242271]: Failed password for invalid user admin from 45.172.153.100 port 38088 ssh2
Sep 13 00:30:15 nativespace-cdp sshd[1242271]: Received disconnect from 45.172.153.100 port 38088:11: Bye Bye [preauth]
Sep 13 00:30:15 nativespace-cdp sshd[1242271]: Disconnected from 45.172.153.100 port 38088 [preauth]
Sep 13 00:30:38 nativespace-cdp sshd[1242338]: Invalid user user from 23.158.56.21 port 40962
Sep 13 00:30:38 nativespace-cdp sshd[1242338]: input_userauth_request: invalid user user [preauth]
Sep 13 00:30:38 nativespace-cdp sshd[1242338]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:30:38 nativespace-cdp sshd[1242338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.158.56.21
Sep 13 00:30:40 nativespace-cdp sshd[1242338]: Failed password for invalid user user from 23.158.56.21 port 40962 ssh2
Sep 13 00:30:40 nativespace-cdp sshd[1242338]: Received disconnect from 23.158.56.21 port 40962:11: Bye Bye [preauth]
Sep 13 00:30:40 nativespace-cdp sshd[1242338]: Disconnected from 23.158.56.21 port 40962 [preauth]
Sep 13 00:30:57 nativespace-cdp sshd[1242377]: Invalid user ftp_user from 202.157.186.116 port 54870
Sep 13 00:30:57 nativespace-cdp sshd[1242377]: input_userauth_request: invalid user ftp_user [preauth]
Sep 13 00:30:57 nativespace-cdp sshd[1242377]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:30:57 nativespace-cdp sshd[1242377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.186.116
Sep 13 00:30:59 nativespace-cdp sshd[1242377]: Failed password for invalid user ftp_user from 202.157.186.116 port 54870 ssh2
Sep 13 00:31:00 nativespace-cdp sshd[1242377]: Received disconnect from 202.157.186.116 port 54870:11: Bye Bye [preauth]
Sep 13 00:31:00 nativespace-cdp sshd[1242377]: Disconnected from 202.157.186.116 port 54870 [preauth]
Sep 13 00:31:08 nativespace-cdp sshd[1242501]: Invalid user user1 from 45.172.153.100 port 44426
Sep 13 00:31:08 nativespace-cdp sshd[1242501]: input_userauth_request: invalid user user1 [preauth]
Sep 13 00:31:08 nativespace-cdp sshd[1242501]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:31:08 nativespace-cdp sshd[1242501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.172.153.100
Sep 13 00:31:10 nativespace-cdp sshd[1242501]: Failed password for invalid user user1 from 45.172.153.100 port 44426 ssh2
Sep 13 00:31:10 nativespace-cdp sshd[1242501]: Received disconnect from 45.172.153.100 port 44426:11: Bye Bye [preauth]
Sep 13 00:31:10 nativespace-cdp sshd[1242501]: Disconnected from 45.172.153.100 port 44426 [preauth]
Sep 13 00:31:12 nativespace-cdp sshd[1242506]: Invalid user tester from 45.175.157.53 port 44452
Sep 13 00:31:12 nativespace-cdp sshd[1242506]: input_userauth_request: invalid user tester [preauth]
Sep 13 00:31:12 nativespace-cdp sshd[1242506]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:31:12 nativespace-cdp sshd[1242506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.175.157.53
Sep 13 00:31:14 nativespace-cdp sshd[1242506]: Failed password for invalid user tester from 45.175.157.53 port 44452 ssh2
Sep 13 00:31:14 nativespace-cdp sshd[1242506]: Received disconnect from 45.175.157.53 port 44452:11: Bye Bye [preauth]
Sep 13 00:31:14 nativespace-cdp sshd[1242506]: Disconnected from 45.175.157.53 port 44452 [preauth]
Sep 13 00:31:22 nativespace-cdp sshd[1242574]: Invalid user postgres from 23.158.56.21 port 53880
Sep 13 00:31:22 nativespace-cdp sshd[1242574]: input_userauth_request: invalid user postgres [preauth]
Sep 13 00:31:22 nativespace-cdp sshd[1242574]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:31:22 nativespace-cdp sshd[1242574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.158.56.21
Sep 13 00:31:24 nativespace-cdp sshd[1242574]: Failed password for invalid user postgres from 23.158.56.21 port 53880 ssh2
Sep 13 00:31:28 nativespace-cdp sshd[1242574]: Received disconnect from 23.158.56.21 port 53880:11: Bye Bye [preauth]
Sep 13 00:31:28 nativespace-cdp sshd[1242574]: Disconnected from 23.158.56.21 port 53880 [preauth]
Sep 13 00:31:33 nativespace-cdp sshd[1242710]: Connection closed by 159.100.136.21 port 49522 [preauth]
Sep 13 00:32:02 nativespace-cdp sshd[1242784]: Invalid user admin from 45.175.157.53 port 57144
Sep 13 00:32:02 nativespace-cdp sshd[1242784]: input_userauth_request: invalid user admin [preauth]
Sep 13 00:32:02 nativespace-cdp sshd[1242784]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:32:02 nativespace-cdp sshd[1242784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.175.157.53
Sep 13 00:32:03 nativespace-cdp sshd[1242784]: Failed password for invalid user admin from 45.175.157.53 port 57144 ssh2
Sep 13 00:32:04 nativespace-cdp sshd[1242784]: Received disconnect from 45.175.157.53 port 57144:11: Bye Bye [preauth]
Sep 13 00:32:04 nativespace-cdp sshd[1242784]: Disconnected from 45.175.157.53 port 57144 [preauth]
Sep 13 00:32:13 nativespace-cdp sshd[1242836]: Invalid user user from 202.157.186.116 port 42322
Sep 13 00:32:13 nativespace-cdp sshd[1242836]: input_userauth_request: invalid user user [preauth]
Sep 13 00:32:13 nativespace-cdp sshd[1242836]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:32:13 nativespace-cdp sshd[1242836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.186.116
Sep 13 00:32:15 nativespace-cdp sshd[1242836]: Failed password for invalid user user from 202.157.186.116 port 42322 ssh2
Sep 13 00:32:15 nativespace-cdp sshd[1242836]: Received disconnect from 202.157.186.116 port 42322:11: Bye Bye [preauth]
Sep 13 00:32:15 nativespace-cdp sshd[1242836]: Disconnected from 202.157.186.116 port 42322 [preauth]
Sep 13 00:32:59 nativespace-cdp sshd[1242952]: Invalid user guest from 202.157.186.116 port 54802
Sep 13 00:32:59 nativespace-cdp sshd[1242952]: input_userauth_request: invalid user guest [preauth]
Sep 13 00:32:59 nativespace-cdp sshd[1242952]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:32:59 nativespace-cdp sshd[1242952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.157.186.116
Sep 13 00:33:01 nativespace-cdp sshd[1242952]: Failed password for invalid user guest from 202.157.186.116 port 54802 ssh2
Sep 13 00:33:01 nativespace-cdp sshd[1242952]: Received disconnect from 202.157.186.116 port 54802:11: Bye Bye [preauth]
Sep 13 00:33:01 nativespace-cdp sshd[1242952]: Disconnected from 202.157.186.116 port 54802 [preauth]
Sep 13 00:33:30 nativespace-cdp sshd[1243054]: Invalid user user01 from 185.227.154.203 port 42286
Sep 13 00:33:30 nativespace-cdp sshd[1243054]: input_userauth_request: invalid user user01 [preauth]
Sep 13 00:33:30 nativespace-cdp sshd[1243054]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:33:30 nativespace-cdp sshd[1243054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.227.154.203
Sep 13 00:33:31 nativespace-cdp sshd[1243054]: Failed password for invalid user user01 from 185.227.154.203 port 42286 ssh2
Sep 13 00:33:32 nativespace-cdp sshd[1243054]: Received disconnect from 185.227.154.203 port 42286:11: Bye Bye [preauth]
Sep 13 00:33:32 nativespace-cdp sshd[1243054]: Disconnected from 185.227.154.203 port 42286 [preauth]
Sep 13 00:33:45 nativespace-cdp sshd[1243095]: Invalid user user from 185.227.154.203 port 43816
Sep 13 00:33:45 nativespace-cdp sshd[1243095]: input_userauth_request: invalid user user [preauth]
Sep 13 00:33:45 nativespace-cdp sshd[1243095]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 00:33:45 nativespace-cdp sshd[1243095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.227.154.203
Sep 13 00:33:47 nativespace-cdp sshd[1243095]: Failed password for invalid user user from 185.227.154.203 port 43816 ssh2
Sep 13 00:33:48 nativespace-cdp sshd[1243095]: Received disconnect from 185.227.154.203 port 43816:11: Bye Bye [preauth]
Sep 13 00:33:48 nativespace-cdp sshd[1243095]: Disconnected from 185.227.154.203 port 43816 [preauth]
Sep 13 00:36:34 nativespace-cdp sshd[1243791]: Connection closed by 159.100.136.21 port 58706 [preauth]
Sep 13 00:41:33 nativespace-cdp sshd[1244938]: Connection closed by 159.100.136.21 port 40020 [preauth]
Sep 13 00:46:33 nativespace-cdp sshd[1246439]: Connection closed by 159.100.136.21 port 49710 [preauth]
Sep 13 00:51:33 nativespace-cdp sshd[1247380]: Connection closed by 159.100.136.21 port 58770 [preauth]
Sep 13 00:56:33 nativespace-cdp sshd[1248966]: Connection closed by 159.100.136.21 port 39982 [preauth]
Sep 13 01:01:33 nativespace-cdp sshd[1250451]: Connection closed by 159.100.136.21 port 49564 [preauth]
Sep 13 01:06:35 nativespace-cdp sshd[1251414]: Connection closed by 159.100.136.21 port 57960 [preauth]
Sep 13 01:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 01:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:30 nativespace-cdp sudo[1251951]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 01:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:30 nativespace-cdp sudo[1251955]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 01:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:30 nativespace-cdp sudo[1251958]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 01:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:31 nativespace-cdp sudo[1251962]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 01:09:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:32 nativespace-cdp sudo[1251966]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 01:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:32 nativespace-cdp sudo[1251976]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 01:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:32 nativespace-cdp sudo[1251979]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 01:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:32 nativespace-cdp sudo[1251982]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 01:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:32 nativespace-cdp sudo[1251985]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 01:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:32 nativespace-cdp sudo[1251988]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 01:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:32 nativespace-cdp sudo[1251994]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 01:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:33 nativespace-cdp sudo[1252006]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:34 nativespace-cdp sudo[1252010]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=alexadmin user-2=skyfirec user-3=stuartge user-4=askhform user-5=innovat1 user-6=nativene user-7=brighto1 user-8=nstriton user-9=battlere user-10=oneoarco user-11=firstre2 user-12=vivienn1 user-13=bedfords user-14=bemadonn user-15=belle user-16=ggaaorgu user-17=newstoda user-18=elecleis user-19=gilpin user-20=milloyco user-21=carsinyo user-22=fetch user-23=putterfi user-24=hubmaster user-25=ianrayne user-26=accooper user-27=thqkgnbz user-28=connectedshoppin user-29=firstres user-30=seftvta user-31=jonhartl user-32=ultbcrra user-33=coursemc user-34=opaiscyx user-35=costestimatorco user-36=firstrel user-37=clarkass user-38=southlon user-39=highlegh user-40=firstred user-41=martsblo user-42=ptkxhsbt user-43=dickemery123 user-44=lbhyisi user-45=hhdugcor user-46=magichat user-47=lakesan1
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=brmrjxl user-49=sarafoundation user-50=atestord user-51=strathar user-52=wilsonsw user-53=musorguk user-54=megacards user-55=jarvisin user-56=hodgesonweb user-57=theblack user-58=spectrum user-59=still user-60=agproduc user-61=leereyn1 user-62=stephani user-63=booff user-64=markward user-65=foundation user-66=maflemin user-67=lbscrmod user-68=connect9 user-69=athenare user-70=vantagep user-71=ulsukarm user-72=what user-73=tstardom user-74=oubpgvbx user-75=nvihkvu user-76=sketchy user-77=cath user-78=havantho user-79=kategilpin user-80=ladburyp user-81=stagingerris user-82=dancinggardener user-83=design user-84=nove user-85=boldover user-86=sosevalu user-87=crrtipdl user-88=bakery user-89=attlebor user-90=lucy user-91=onlycont user-92=branko user-93=outdoorc user-94=ranxterc user-95=hodgsonmail user-96=romaldki user-97=tomandle user-98=jennimil user-99=mcdermos user-100=chrisdal user-101=nbhavers
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=careers user-103=david user-104=ninejimm user-105=reliable user-106=cambria1 user-107=cathski user-108=pugwash user-109=howardon user-110=paulmca1 user-111=cwsocial user-112=hirefootballgame user-113=courseme user-114=eugincou user-115=health2045 user-116=fortunaz user-117=leftie user-118=foods user-119=putterfc user-120=nscdp user-121=philmcph user-122=ctedorgu user-123=donnychicago user-124=steakbridieme user-125=firstre5 user-126=lkpier user-127=isleofwi user-128=smrszyqg user-129=tigerlet user-130=barbersh user-131=hidden user-132=nomistakes user-133=burydropin user-134=fawcettd user-135=nsceres user-136=eatspam user-137=darkstar user-138=beauty user-139=dhyana user-140=sibtoncc user-141=asandcoc user-142=zebrapho user-143=bwppodcast user-144=steve feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:34 nativespace-cdp sudo[1252015]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:34 nativespace-cdp sudo[1252020]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-MrCjJsqgep22cmjR.~
Sep 13 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:34 nativespace-cdp sudo[1252024]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-MrCjJsqgep22cmjR.~'
Sep 13 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:34 nativespace-cdp sudo[1252027]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-MrCjJsqgep22cmjR.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:34 nativespace-cdp sudo[1252031]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 01:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:34 nativespace-cdp sudo[1252035]: pam_unix(sudo:session): session closed for user root
Sep 13 01:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 01:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 01:09:36 nativespace-cdp sudo[1252055]: pam_unix(sudo:session): session closed for user root
Sep 13 01:11:33 nativespace-cdp sshd[1252542]: Connection closed by 159.100.136.21 port 38382 [preauth]
Sep 13 01:16:36 nativespace-cdp sshd[1253823]: Connection closed by 159.100.136.21 port 47918 [preauth]
Sep 13 01:21:35 nativespace-cdp sshd[1255369]: Connection closed by 159.100.136.21 port 56636 [preauth]
Sep 13 01:26:37 nativespace-cdp sshd[1256490]: Connection closed by 159.100.136.21 port 37684 [preauth]
Sep 13 01:31:33 nativespace-cdp sshd[1257942]: Connection closed by 159.100.136.21 port 47238 [preauth]
Sep 13 01:36:33 nativespace-cdp sshd[1258946]: Connection closed by 159.100.136.21 port 56876 [preauth]
Sep 13 01:41:35 nativespace-cdp sshd[1260087]: Connection closed by 159.100.136.21 port 38148 [preauth]
Sep 13 01:46:33 nativespace-cdp sshd[1261191]: Connection closed by 159.100.136.21 port 47610 [preauth]
Sep 13 01:51:33 nativespace-cdp sshd[1262391]: Connection closed by 159.100.136.21 port 56948 [preauth]
Sep 13 01:56:33 nativespace-cdp sshd[1263650]: Connection closed by 159.100.136.21 port 38622 [preauth]
Sep 13 02:01:34 nativespace-cdp sshd[1265245]: Connection closed by 159.100.136.21 port 47558 [preauth]
Sep 13 02:06:34 nativespace-cdp sshd[1266327]: Connection closed by 159.100.136.21 port 55596 [preauth]
Sep 13 02:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 02:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:37 nativespace-cdp sudo[1266927]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 02:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:37 nativespace-cdp sudo[1266931]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 02:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:40 nativespace-cdp sudo[1266934]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 02:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:40 nativespace-cdp sudo[1266949]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 02:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:43 nativespace-cdp sudo[1266953]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:43 nativespace-cdp sudo[1266970]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:43 nativespace-cdp sudo[1266973]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:43 nativespace-cdp sudo[1266976]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:43 nativespace-cdp sudo[1266980]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:44 nativespace-cdp sudo[1266983]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 02:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:44 nativespace-cdp sudo[1266986]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 02:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:09:58 nativespace-cdp sudo[1267019]: pam_unix(sudo:session): session closed for user root
Sep 13 02:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 02:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:10:05 nativespace-cdp sudo[1267024]: pam_unix(sudo:session): session closed for user root
Sep 13 02:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=dancinggardener user-2=stagingerris user-3=ladburyp user-4=kategilpin user-5=design user-6=tstardom user-7=oubpgvbx user-8=what user-9=havantho user-10=sketchy user-11=cath user-12=nvihkvu user-13=bakery user-14=crrtipdl user-15=sosevalu user-16=nove user-17=boldover user-18=hodgsonmail user-19=outdoorc user-20=ranxterc user-21=branko user-22=romaldki user-23=lucy user-24=attlebor user-25=onlycont user-26=chrisdal user-27=mcdermos user-28=david user-29=nbhavers user-30=careers user-31=tomandle user-32=jennimil user-33=hirefootballgame user-34=eugincou user-35=courseme user-36=cambria1 user-37=cathski user-38=reliable user-39=ninejimm user-40=cwsocial user-41=paulmca1 user-42=pugwash user-43=howardon user-44=isleofwi user-45=smrszyqg user-46=nomistakes user-47=hidden user-48=tigerlet
Sep 13 02:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=barbersh user-50=nscdp user-51=putterfc user-52=foods user-53=leftie user-54=fortunaz user-55=health2045 user-56=lkpier user-57=donnychicago user-58=firstre5 user-59=steakbridieme user-60=philmcph user-61=ctedorgu user-62=beauty user-63=darkstar user-64=eatspam user-65=dhyana user-66=fawcettd user-67=burydropin user-68=nsceres user-69=bwppodcast user-70=zebrapho user-71=steve user-72=sibtoncc user-73=asandcoc user-74=innovat1 user-75=askhform user-76=stuartge user-77=nativene user-78=alexadmin user-79=skyfirec user-80=bedfords user-81=newstoda user-82=belle user-83=ggaaorgu user-84=bemadonn user-85=nstriton user-86=brighto1 user-87=vivienn1 user-88=firstre2 user-89=oneoarco user-90=battlere user-91=accooper user-92=ianrayne user-93=connectedshoppin user-94=thqkgnbz user-95=gilpin user-96=milloyco user-97=elecleis user-98=putterfi user-99=hubmaster user-100=fetch user-101=carsinyo user-102=firstrel
Sep 13 02:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=clarkass user-104=costestimatorco user-105=firstred user-106=highlegh user-107=southlon user-108=ultbcrra user-109=jonhartl user-110=seftvta user-111=firstres user-112=coursemc user-113=opaiscyx user-114=hhdugcor user-115=lbhyisi user-116=magichat user-117=martsblo user-118=dickemery123 user-119=ptkxhsbt user-120=wilsonsw user-121=megacards user-122=musorguk user-123=lakesan1 user-124=brmrjxl user-125=strathar user-126=atestord user-127=sarafoundation user-128=agproduc user-129=still user-130=stephani user-131=leereyn1 user-132=jarvisin user-133=spectrum user-134=theblack user-135=hodgesonweb user-136=ulsukarm user-137=booff user-138=foundation user-139=markward user-140=vantagep user-141=athenare user-142=connect9 user-143=lbscrmod user-144=maflemin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 02:10:06 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 02:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:10:07 nativespace-cdp sudo[1267154]: pam_unix(sudo:session): session closed for user root
Sep 13 02:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 02:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:10:08 nativespace-cdp sudo[1267172]: pam_unix(sudo:session): session closed for user root
Sep 13 02:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tahBmwHLmAvqiV9H.~
Sep 13 02:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:10:09 nativespace-cdp sudo[1267179]: pam_unix(sudo:session): session closed for user root
Sep 13 02:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tahBmwHLmAvqiV9H.~'
Sep 13 02:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:10:09 nativespace-cdp sudo[1267182]: pam_unix(sudo:session): session closed for user root
Sep 13 02:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-tahBmwHLmAvqiV9H.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 02:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:10:09 nativespace-cdp sudo[1267186]: pam_unix(sudo:session): session closed for user root
Sep 13 02:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 02:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:10:09 nativespace-cdp sudo[1267189]: pam_unix(sudo:session): session closed for user root
Sep 13 02:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 02:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 02:10:11 nativespace-cdp sudo[1267210]: pam_unix(sudo:session): session closed for user root
Sep 13 02:11:34 nativespace-cdp sshd[1267555]: Connection closed by 159.100.136.21 port 36558 [preauth]
Sep 13 02:16:33 nativespace-cdp sshd[1269092]: Connection closed by 159.100.136.21 port 46018 [preauth]
Sep 13 02:21:36 nativespace-cdp sshd[1270150]: Connection closed by 159.100.136.21 port 55140 [preauth]
Sep 13 02:26:34 nativespace-cdp sshd[1271277]: Connection closed by 159.100.136.21 port 36508 [preauth]
Sep 13 02:31:33 nativespace-cdp sshd[1272774]: Connection closed by 159.100.136.21 port 45734 [preauth]
Sep 13 02:36:33 nativespace-cdp sshd[1273785]: Connection closed by 159.100.136.21 port 55138 [preauth]
Sep 13 02:41:33 nativespace-cdp sshd[1274935]: Connection closed by 159.100.136.21 port 36050 [preauth]
Sep 13 02:46:33 nativespace-cdp sshd[1276432]: Connection closed by 159.100.136.21 port 44704 [preauth]
Sep 13 02:51:34 nativespace-cdp sshd[1277519]: Connection closed by 159.100.136.21 port 53352 [preauth]
Sep 13 02:56:34 nativespace-cdp sshd[1278787]: Connection closed by 159.100.136.21 port 34656 [preauth]
Sep 13 03:01:33 nativespace-cdp sshd[1280216]: Connection closed by 159.100.136.21 port 44190 [preauth]
Sep 13 03:06:33 nativespace-cdp sshd[1281198]: Connection closed by 159.100.136.21 port 53798 [preauth]
Sep 13 03:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 03:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:37 nativespace-cdp sudo[1281743]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 03:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:37 nativespace-cdp sudo[1281750]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 03:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:41 nativespace-cdp sudo[1281753]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 03:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:41 nativespace-cdp sudo[1281770]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 03:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:45 nativespace-cdp sudo[1281773]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 03:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:45 nativespace-cdp sudo[1281788]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 03:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:45 nativespace-cdp sudo[1281791]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 03:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:45 nativespace-cdp sudo[1281794]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 03:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:45 nativespace-cdp sudo[1281797]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 03:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:45 nativespace-cdp sudo[1281801]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 03:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:45 nativespace-cdp sudo[1281804]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 03:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:49 nativespace-cdp sudo[1281817]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 03:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:56 nativespace-cdp sudo[1281821]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=mcdermos user-2=chrisdal user-3=careers user-4=nbhavers user-5=david user-6=tomandle user-7=jennimil user-8=branko user-9=hodgsonmail user-10=ranxterc user-11=outdoorc user-12=romaldki user-13=attlebor user-14=lucy user-15=onlycont user-16=sosevalu user-17=crrtipdl user-18=bakery user-19=nove user-20=boldover user-21=kategilpin user-22=ladburyp user-23=stagingerris user-24=dancinggardener user-25=design user-26=what user-27=oubpgvbx user-28=tstardom user-29=nvihkvu user-30=cath user-31=sketchy user-32=havantho user-33=zebrapho user-34=bwppodcast user-35=steve user-36=sibtoncc user-37=asandcoc user-38=eatspam user-39=darkstar user-40=beauty user-41=dhyana user-42=burydropin user-43=fawcettd user-44=nsceres user-45=isleofwi user-46=smrszyqg user-47=tigerlet user-48=barbersh user-49=hidden
Sep 13 03:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=nomistakes user-51=health2045 user-52=fortunaz user-53=foods user-54=leftie user-55=putterfc user-56=nscdp user-57=ctedorgu user-58=philmcph user-59=donnychicago user-60=firstre5 user-61=steakbridieme user-62=lkpier user-63=hirefootballgame user-64=courseme user-65=eugincou user-66=ninejimm user-67=reliable user-68=cathski user-69=cambria1 user-70=pugwash user-71=paulmca1 user-72=howardon user-73=cwsocial user-74=costestimatorco user-75=clarkass user-76=firstrel user-77=southlon user-78=highlegh user-79=firstred user-80=firstres user-81=seftvta user-82=jonhartl user-83=ultbcrra user-84=coursemc user-85=opaiscyx user-86=ianrayne user-87=accooper user-88=thqkgnbz user-89=connectedshoppin user-90=elecleis user-91=milloyco user-92=gilpin user-93=carsinyo user-94=fetch user-95=putterfi user-96=hubmaster user-97=bedfords user-98=bemadonn user-99=belle user-100=ggaaorgu user-101=newstoda user-102=brighto1
Sep 13 03:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=nstriton user-104=battlere user-105=oneoarco user-106=firstre2 user-107=vivienn1 user-108=askhform user-109=stuartge user-110=innovat1 user-111=nativene user-112=alexadmin user-113=skyfirec user-114=ulsukarm user-115=booff user-116=foundation user-117=markward user-118=maflemin user-119=lbscrmod user-120=athenare user-121=connect9 user-122=vantagep user-123=still user-124=agproduc user-125=leereyn1 user-126=stephani user-127=jarvisin user-128=theblack user-129=hodgesonweb user-130=spectrum user-131=wilsonsw user-132=musorguk user-133=megacards user-134=lakesan1 user-135=brmrjxl user-136=sarafoundation user-137=atestord user-138=strathar user-139=lbhyisi user-140=hhdugcor user-141=magichat user-142=martsblo user-143=ptkxhsbt user-144=dickemery123 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 03:09:56 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 03:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:58 nativespace-cdp sudo[1281840]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:58 nativespace-cdp sudo[1281847]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8UOKxkuOGBKL8Qv2.~
Sep 13 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:58 nativespace-cdp sudo[1281851]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8UOKxkuOGBKL8Qv2.~'
Sep 13 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:58 nativespace-cdp sudo[1281854]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8UOKxkuOGBKL8Qv2.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:58 nativespace-cdp sudo[1281858]: pam_unix(sudo:session): session closed for user root
Sep 13 03:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 03:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:09:58 nativespace-cdp sudo[1281861]: pam_unix(sudo:session): session closed for user root
Sep 13 03:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 03:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 03:10:00 nativespace-cdp sudo[1281881]: pam_unix(sudo:session): session closed for user root
Sep 13 03:11:34 nativespace-cdp sshd[1282397]: Connection closed by 159.100.136.21 port 33990 [preauth]
Sep 13 03:16:34 nativespace-cdp sshd[1283876]: Connection closed by 159.100.136.21 port 42768 [preauth]
Sep 13 03:21:36 nativespace-cdp sshd[1285124]: Connection closed by 159.100.136.21 port 51532 [preauth]
Sep 13 03:26:33 nativespace-cdp sshd[1286123]: Connection closed by 159.100.136.21 port 60660 [preauth]
Sep 13 03:31:34 nativespace-cdp sshd[1287355]: Connection closed by 159.100.136.21 port 41574 [preauth]
Sep 13 03:36:34 nativespace-cdp sshd[1288359]: Connection closed by 159.100.136.21 port 50456 [preauth]
Sep 13 03:41:33 nativespace-cdp sshd[1289925]: Connection closed by 159.100.136.21 port 59256 [preauth]
Sep 13 03:46:33 nativespace-cdp sshd[1291738]: Connection closed by 159.100.136.21 port 39840 [preauth]
Sep 13 03:51:35 nativespace-cdp sshd[1292834]: Connection closed by 159.100.136.21 port 49008 [preauth]
Sep 13 03:56:34 nativespace-cdp sshd[1294021]: Connection closed by 159.100.136.21 port 58528 [preauth]
Sep 13 04:01:33 nativespace-cdp sshd[1295370]: Connection closed by 159.100.136.21 port 39078 [preauth]
Sep 13 04:06:33 nativespace-cdp sshd[1296350]: Connection closed by 159.100.136.21 port 48602 [preauth]
Sep 13 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:38 nativespace-cdp sudo[1296971]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:38 nativespace-cdp sudo[1296974]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 04:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:43 nativespace-cdp sudo[1296977]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 04:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:43 nativespace-cdp sudo[1297004]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 04:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:48 nativespace-cdp sudo[1297007]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:48 nativespace-cdp sudo[1297018]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:48 nativespace-cdp sudo[1297021]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:48 nativespace-cdp sudo[1297024]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:48 nativespace-cdp sudo[1297028]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:48 nativespace-cdp sudo[1297031]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 04:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:48 nativespace-cdp sudo[1297034]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 04:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:09:55 nativespace-cdp sudo[1297059]: pam_unix(sudo:session): session closed for user root
Sep 13 04:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 04:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:10:02 nativespace-cdp sudo[1297063]: pam_unix(sudo:session): session closed for user root
Sep 13 04:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=stagingerris user-2=dancinggardener user-3=ladburyp user-4=kategilpin user-5=design user-6=oubpgvbx user-7=tstardom user-8=what user-9=havantho user-10=sketchy user-11=cath user-12=nvihkvu user-13=bakery user-14=crrtipdl user-15=sosevalu user-16=nove user-17=boldover user-18=ranxterc user-19=hodgsonmail user-20=outdoorc user-21=branko user-22=romaldki user-23=lucy user-24=attlebor user-25=onlycont user-26=chrisdal user-27=mcdermos user-28=david user-29=nbhavers user-30=careers user-31=tomandle user-32=jennimil user-33=hirefootballgame user-34=eugincou user-35=courseme user-36=cathski user-37=cambria1 user-38=ninejimm user-39=reliable user-40=cwsocial user-41=howardon user-42=pugwash user-43=paulmca1 user-44=smrszyqg user-45=isleofwi user-46=nomistakes user-47=hidden user-48=tigerlet
Sep 13 04:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=barbersh user-50=nscdp user-51=putterfc user-52=foods user-53=leftie user-54=fortunaz user-55=health2045 user-56=lkpier user-57=firstre5 user-58=donnychicago user-59=steakbridieme user-60=philmcph user-61=ctedorgu user-62=beauty user-63=darkstar user-64=eatspam user-65=dhyana user-66=fawcettd user-67=burydropin user-68=nsceres user-69=bwppodcast user-70=zebrapho user-71=steve user-72=asandcoc user-73=sibtoncc user-74=innovat1 user-75=stuartge user-76=askhform user-77=nativene user-78=skyfirec user-79=alexadmin user-80=bedfords user-81=newstoda user-82=ggaaorgu user-83=belle user-84=bemadonn user-85=nstriton user-86=brighto1 user-87=vivienn1 user-88=firstre2 user-89=oneoarco user-90=battlere user-91=accooper user-92=ianrayne user-93=connectedshoppin user-94=thqkgnbz user-95=milloyco user-96=gilpin user-97=elecleis user-98=hubmaster user-99=putterfi user-100=fetch user-101=carsinyo user-102=firstrel
Sep 13 04:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=clarkass user-104=costestimatorco user-105=firstred user-106=highlegh user-107=southlon user-108=ultbcrra user-109=jonhartl user-110=seftvta user-111=firstres user-112=coursemc user-113=opaiscyx user-114=hhdugcor user-115=lbhyisi user-116=magichat user-117=martsblo user-118=dickemery123 user-119=ptkxhsbt user-120=wilsonsw user-121=megacards user-122=musorguk user-123=brmrjxl user-124=lakesan1 user-125=strathar user-126=atestord user-127=sarafoundation user-128=agproduc user-129=still user-130=stephani user-131=leereyn1 user-132=jarvisin user-133=spectrum user-134=hodgesonweb user-135=theblack user-136=ulsukarm user-137=booff user-138=markward user-139=foundation user-140=vantagep user-141=athenare user-142=connect9 user-143=lbscrmod user-144=maflemin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 04:10:02 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 04:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:10:05 nativespace-cdp sudo[1297156]: pam_unix(sudo:session): session closed for user root
Sep 13 04:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 04:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:10:07 nativespace-cdp sudo[1297207]: pam_unix(sudo:session): session closed for user root
Sep 13 04:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cVRc84YblDvUyKdP.~
Sep 13 04:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:10:07 nativespace-cdp sudo[1297211]: pam_unix(sudo:session): session closed for user root
Sep 13 04:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cVRc84YblDvUyKdP.~'
Sep 13 04:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:10:07 nativespace-cdp sudo[1297214]: pam_unix(sudo:session): session closed for user root
Sep 13 04:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-cVRc84YblDvUyKdP.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 04:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:10:07 nativespace-cdp sudo[1297218]: pam_unix(sudo:session): session closed for user root
Sep 13 04:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 04:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:10:07 nativespace-cdp sudo[1297221]: pam_unix(sudo:session): session closed for user root
Sep 13 04:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 04:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:10:17 nativespace-cdp sudo[1297314]: pam_unix(sudo:session): session closed for user root
Sep 13 04:16:33 nativespace-cdp sshd[1298948]: Connection closed by 159.100.136.21 port 38394 [preauth]
Sep 13 04:21:33 nativespace-cdp sshd[1300272]: Connection closed by 159.100.136.21 port 47384 [preauth]
Sep 13 04:26:33 nativespace-cdp sshd[1301515]: Connection closed by 159.100.136.21 port 56768 [preauth]
Sep 13 04:31:32 nativespace-cdp sshd[1302972]: Connection closed by 159.100.136.21 port 36894 [preauth]
Sep 13 04:36:37 nativespace-cdp sshd[1304601]: Connection closed by 159.100.136.21 port 46478 [preauth]
Sep 13 04:41:34 nativespace-cdp sshd[1306981]: Connection closed by 159.100.136.21 port 54884 [preauth]
Sep 13 04:46:33 nativespace-cdp sshd[1308893]: Connection closed by 159.100.136.21 port 36544 [preauth]
Sep 13 04:48:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 04:48:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:48:13 nativespace-cdp sudo[1309215]: pam_unix(sudo:session): session closed for user root
Sep 13 04:51:34 nativespace-cdp sshd[1310030]: Connection closed by 159.100.136.21 port 45686 [preauth]
Sep 13 04:56:31 nativespace-cdp sshd[1311076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.53.29.209  user=root
Sep 13 04:56:31 nativespace-cdp sshd[1311076]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 04:56:33 nativespace-cdp sshd[1311083]: Connection closed by 159.100.136.21 port 54812 [preauth]
Sep 13 04:56:33 nativespace-cdp sshd[1311076]: Failed password for root from 161.53.29.209 port 51962 ssh2
Sep 13 04:56:33 nativespace-cdp sshd[1311076]: Received disconnect from 161.53.29.209 port 51962:11: Bye Bye [preauth]
Sep 13 04:56:33 nativespace-cdp sshd[1311076]: Disconnected from 161.53.29.209 port 51962 [preauth]
Sep 13 04:56:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 04:56:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:56:38 nativespace-cdp sudo[1311099]: pam_unix(sudo:session): session closed for user root
Sep 13 04:56:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 04:56:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:56:38 nativespace-cdp sudo[1311109]: pam_unix(sudo:session): session closed for user root
Sep 13 04:56:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 04:56:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:56:45 nativespace-cdp sudo[1311127]: pam_unix(sudo:session): session closed for user root
Sep 13 04:56:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=isleofwi user-2=smrszyqg user-3=hidden user-4=nomistakes user-5=barbersh user-6=tigerlet user-7=putterfc user-8=nscdp user-9=health2045 user-10=fortunaz user-11=foods user-12=leftie user-13=lkpier user-14=philmcph user-15=ctedorgu user-16=firstre5 user-17=donnychicago user-18=steakbridieme user-19=hirefootballgame user-20=eugincou user-21=courseme user-22=cambria1 user-23=cathski user-24=ninejimm user-25=reliable user-26=pugwash user-27=paulmca1 user-28=howardon user-29=cwsocial user-30=bwppodcast user-31=zebrapho user-32=steve user-33=asandcoc user-34=sibtoncc user-35=beauty user-36=eatspam user-37=darkstar user-38=dhyana user-39=burydropin user-40=fawcettd user-41=nsceres user-42=bakery user-43=sosevalu user-44=crrtipdl user-45=nove user-46=boldover user-47=ladburyp user-48=stagingerris
Sep 13 04:56:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=dancinggardener user-50=kategilpin user-51=design user-52=tstardom user-53=oubpgvbx user-54=what user-55=cath user-56=sketchy user-57=havantho user-58=nvihkvu user-59=chrisdal user-60=mcdermos user-61=careers user-62=nbhavers user-63=david user-64=tomandle user-65=jennimil user-66=ranxterc user-67=hodgsonmail user-68=outdoorc user-69=branko user-70=romaldki user-71=attlebor user-72=lucy user-73=onlycont user-74=wilsonsw user-75=musorguk user-76=megacards user-77=brmrjxl user-78=lakesan1 user-79=strathar user-80=sarafoundation user-81=atestord user-82=lbhyisi user-83=hhdugcor user-84=magichat user-85=martsblo user-86=dickemery123 user-87=ptkxhsbt user-88=ulsukarm user-89=booff user-90=markward user-91=foundation user-92=connect9 user-93=athenare user-94=vantagep user-95=maflemin user-96=lbscrmod user-97=still user-98=agproduc user-99=stephani user-100=leereyn1 user-101=jarvisin user-102=spectrum
Sep 13 04:56:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=theblack user-104=hodgesonweb user-105=bedfords user-106=ggaaorgu user-107=belle user-108=newstoda user-109=bemadonn user-110=brighto1 user-111=nstriton user-112=firstre2 user-113=vivienn1 user-114=battlere user-115=oneoarco user-116=innovat1 user-117=stuartge user-118=askhform user-119=nativene user-120=alexadmin user-121=skyfirec user-122=clarkass user-123=firstrel user-124=costestimatorco user-125=firstred user-126=southlon user-127=highlegh user-128=jonhartl user-129=seftvta user-130=ultbcrra user-131=firstres user-132=coursemc user-133=opaiscyx user-134=accooper user-135=ianrayne user-136=connectedshoppin user-137=thqkgnbz user-138=milloyco user-139=gilpin user-140=elecleis user-141=putterfi user-142=hubmaster user-143=carsinyo user-144=fetch feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 04:56:45 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 04:56:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:56:46 nativespace-cdp sudo[1311138]: pam_unix(sudo:session): session closed for user root
Sep 13 04:56:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 13 04:56:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:56:48 nativespace-cdp sudo[1311146]: pam_unix(sudo:session): session closed for user root
Sep 13 04:56:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=onlycont --output=json
Sep 13 04:56:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:56:49 nativespace-cdp sudo[1311151]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 13 04:57:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 04:57:26 nativespace-cdp sudo[1311371]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 04:57:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user onlycont --user-current --json
Sep 13 04:57:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:57:27 nativespace-cdp sudo[1311378]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont LangPHP php_get_vhost_versions --output=json
Sep 13 04:57:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:57:30 nativespace-cdp sudo[1311385]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep 13 04:57:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:57:37 nativespace-cdp sudo[1311392]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 13 04:57:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:57:37 nativespace-cdp sudo[1311420]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DomainInfo single_domain_data domain=apexred.com return_https_redirect_status=1 --output=json
Sep 13 04:57:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:57:40 nativespace-cdp sudo[1311432]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep 13 04:57:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:57:47 nativespace-cdp sudo[1311440]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep 13 04:57:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:57:48 nativespace-cdp sudo[1311463]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont Mime list_redirects --output=json
Sep 13 04:57:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:57:48 nativespace-cdp sudo[1311467]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DirectoryPrivacy is_directory_protected dir=/home/onlycont/public_html/wp --output=json
Sep 13 04:57:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:57:52 nativespace-cdp sudo[1311531]: pam_unix(sudo:session): session closed for user root
Sep 13 04:57:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 13 04:57:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 04:57:55 nativespace-cdp sudo[1311589]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 04:57:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 13 04:57:55 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 13 04:57:55 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 13 04:57:55 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:57:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 04:57:56 nativespace-cdp sudo[1311595]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 04:57:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 13 04:57:56 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 13 04:57:56 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 13 04:57:56 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:57:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 04:57:57 nativespace-cdp sudo[1311601]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 04:57:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 13 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 13 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 13 04:57:57 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:57:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 04:57:59 nativespace-cdp sudo[1311610]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 04:58:02 nativespace-cdp sshd[1311643]: Invalid user toto from 103.107.91.91 port 41436
Sep 13 04:58:02 nativespace-cdp sshd[1311643]: input_userauth_request: invalid user toto [preauth]
Sep 13 04:58:02 nativespace-cdp sshd[1311643]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 04:58:02 nativespace-cdp sshd[1311643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.107.91.91
Sep 13 04:58:04 nativespace-cdp sshd[1311643]: Failed password for invalid user toto from 103.107.91.91 port 41436 ssh2
Sep 13 04:58:06 nativespace-cdp sshd[1311643]: Received disconnect from 103.107.91.91 port 41436:11: Bye Bye [preauth]
Sep 13 04:58:06 nativespace-cdp sshd[1311643]: Disconnected from 103.107.91.91 port 41436 [preauth]
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 13 04:58:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 04:58:13 nativespace-cdp sudo[1311757]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:58:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 04:58:13 nativespace-cdp sudo[1311763]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:58:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 04:58:13 nativespace-cdp sudo[1311769]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 13 04:58:13 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:58:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 04:58:13 nativespace-cdp sudo[1311775]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 04:58:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 13 04:58:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:58:17 nativespace-cdp sudo[1311813]: pam_unix(sudo:session): session closed for user root
Sep 13 04:58:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep 13 04:58:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:58:17 nativespace-cdp sudo[1311819]: pam_unix(sudo:session): session closed for user root
Sep 13 04:58:37 nativespace-cdp sshd[1311987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.113.181.175  user=root
Sep 13 04:58:37 nativespace-cdp sshd[1311987]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 04:58:39 nativespace-cdp sshd[1311987]: Failed password for root from 20.113.181.175 port 39578 ssh2
Sep 13 04:58:39 nativespace-cdp sshd[1311987]: Received disconnect from 20.113.181.175 port 39578:11: Bye Bye [preauth]
Sep 13 04:58:39 nativespace-cdp sshd[1311987]: Disconnected from 20.113.181.175 port 39578 [preauth]
Sep 13 04:58:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 13 04:58:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 04:58:50 nativespace-cdp sudo[1312097]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 04:58:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 13 04:58:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:58:51 nativespace-cdp sudo[1312104]: pam_unix(sudo:session): session closed for user root
Sep 13 04:58:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep 13 04:58:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:58:52 nativespace-cdp sudo[1312110]: pam_unix(sudo:session): session closed for user root
Sep 13 04:58:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep 13 04:58:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:58:56 nativespace-cdp sudo[1312115]: pam_unix(sudo:session): session closed for user root
Sep 13 04:58:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 13 04:58:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:58:56 nativespace-cdp sudo[1312194]: pam_unix(sudo:session): session closed for user root
Sep 13 04:58:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep 13 04:58:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:58:59 nativespace-cdp sudo[1312235]: pam_unix(sudo:session): session closed for user root
Sep 13 04:58:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep 13 04:58:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:59:00 nativespace-cdp sudo[1312242]: pam_unix(sudo:session): session closed for user root
Sep 13 04:59:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep 13 04:59:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:59:09 nativespace-cdp sudo[1312322]: pam_unix(sudo:session): session closed for user root
Sep 13 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 13 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 04:59:12 nativespace-cdp sudo[1312386]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 04:59:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 13 04:59:12 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 13 04:59:12 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 13 04:59:12 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:59:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 04:59:13 nativespace-cdp sudo[1312393]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 04:59:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 13 04:59:13 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 13 04:59:13 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 13 04:59:13 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:59:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 04:59:36 nativespace-cdp sudo[1312400]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 04:59:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 13 04:59:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 04:59:46 nativespace-cdp sudo[1312569]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 04:59:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 13 04:59:46 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 13 04:59:46 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 13 04:59:46 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:59:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 04:59:46 nativespace-cdp sudo[1312575]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 04:59:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 13 04:59:46 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 13 04:59:46 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 13 04:59:46 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 04:59:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 04:59:46 nativespace-cdp sudo[1312581]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 04:59:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 13 04:59:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:59:49 nativespace-cdp sudo[1312617]: pam_unix(sudo:session): session closed for user root
Sep 13 04:59:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep 13 04:59:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 04:59:49 nativespace-cdp sudo[1312625]: pam_unix(sudo:session): session closed for user root
Sep 13 05:00:50 nativespace-cdp sshd[1313033]: Invalid user rb from 182.93.50.90 port 33656
Sep 13 05:00:50 nativespace-cdp sshd[1313033]: input_userauth_request: invalid user rb [preauth]
Sep 13 05:00:50 nativespace-cdp sshd[1313033]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:00:50 nativespace-cdp sshd[1313033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.93.50.90
Sep 13 05:00:52 nativespace-cdp sshd[1313033]: Failed password for invalid user rb from 182.93.50.90 port 33656 ssh2
Sep 13 05:00:53 nativespace-cdp sshd[1313033]: Received disconnect from 182.93.50.90 port 33656:11: Bye Bye [preauth]
Sep 13 05:00:53 nativespace-cdp sshd[1313033]: Disconnected from 182.93.50.90 port 33656 [preauth]
Sep 13 05:01:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 13 05:01:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 05:01:09 nativespace-cdp sudo[1313113]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 05:01:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep 13 05:01:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:10 nativespace-cdp sudo[1313119]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep 13 05:01:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:12 nativespace-cdp sudo[1313130]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 13 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:12 nativespace-cdp sudo[1313142]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep 13 05:01:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:15 nativespace-cdp sudo[1313158]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep 13 05:01:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:15 nativespace-cdp sudo[1313169]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep 13 05:01:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:22 nativespace-cdp sudo[1313239]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 13 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 05:01:25 nativespace-cdp sudo[1313297]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 05:01:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 13 05:01:25 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 13 05:01:25 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 13 05:01:25 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:01:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 05:01:26 nativespace-cdp sudo[1313303]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 05:01:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 13 05:01:26 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 13 05:01:26 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 13 05:01:26 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:01:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 05:01:31 nativespace-cdp sshd[1313324]: Invalid user aaa from 151.57.102.149 port 54453
Sep 13 05:01:31 nativespace-cdp sshd[1313324]: input_userauth_request: invalid user aaa [preauth]
Sep 13 05:01:31 nativespace-cdp sshd[1313324]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:01:31 nativespace-cdp sshd[1313324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.57.102.149
Sep 13 05:01:32 nativespace-cdp sshd[1313324]: Failed password for invalid user aaa from 151.57.102.149 port 54453 ssh2
Sep 13 05:01:32 nativespace-cdp sshd[1313324]: Received disconnect from 151.57.102.149 port 54453:11: Bye Bye [preauth]
Sep 13 05:01:32 nativespace-cdp sshd[1313324]: Disconnected from 151.57.102.149 port 54453 [preauth]
Sep 13 05:01:33 nativespace-cdp sshd[1313332]: Connection closed by 159.100.136.21 port 36172 [preauth]
Sep 13 05:01:39 nativespace-cdp sudo[1313309]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 05:01:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 13 05:01:39 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 13 05:01:39 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 13 05:01:39 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:01:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 05:01:41 nativespace-cdp sudo[1313357]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 13 05:01:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 05:01:49 nativespace-cdp sudo[1313484]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:01:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 05:01:49 nativespace-cdp sudo[1313490]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:01:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 05:01:49 nativespace-cdp sudo[1313496]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 13 05:01:49 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:01:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 05:01:49 nativespace-cdp sudo[1313504]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 05:01:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 13 05:01:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:53 nativespace-cdp sudo[1313544]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep 13 05:01:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:53 nativespace-cdp sudo[1313553]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep 13 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:54 nativespace-cdp sudo[1313569]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep 13 05:01:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:55 nativespace-cdp sudo[1313577]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 13 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 13 05:01:55 nativespace-cdp sudo[1313587]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 13 05:01:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep 13 05:01:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:56 nativespace-cdp sudo[1313594]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep 13 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:56 nativespace-cdp sudo[1313599]: pam_unix(sudo:session): session closed for user root
Sep 13 05:01:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 13 05:01:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:01:56 nativespace-cdp sudo[1313606]: pam_unix(sudo:session): session closed for user root
Sep 13 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 13 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 05:02:35 nativespace-cdp sudo[1313784]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 13 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:02:36 nativespace-cdp sudo[1313790]: pam_unix(sudo:session): session closed for user root
Sep 13 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 13 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:02:36 nativespace-cdp sudo[1313795]: pam_unix(sudo:session): session closed for user root
Sep 13 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep 13 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:02:41 nativespace-cdp sudo[1313808]: pam_unix(sudo:session): session closed for user root
Sep 13 05:02:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep 13 05:02:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:02:47 nativespace-cdp sudo[1313954]: pam_unix(sudo:session): session closed for user root
Sep 13 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 13 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 05:02:51 nativespace-cdp sudo[1314013]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 05:02:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 13 05:02:51 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 13 05:02:51 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 13 05:02:51 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:02:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 05:02:51 nativespace-cdp sshd[1314017]: Invalid user user from 62.169.20.73 port 33572
Sep 13 05:02:51 nativespace-cdp sshd[1314017]: input_userauth_request: invalid user user [preauth]
Sep 13 05:02:51 nativespace-cdp sshd[1314017]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:02:51 nativespace-cdp sshd[1314017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.169.20.73
Sep 13 05:02:52 nativespace-cdp sudo[1314021]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 05:02:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 13 05:02:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 13 05:02:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 13 05:02:52 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:02:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 05:02:52 nativespace-cdp sshd[1314022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.44.61.94  user=root
Sep 13 05:02:52 nativespace-cdp sshd[1314022]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 05:02:53 nativespace-cdp sshd[1314017]: Failed password for invalid user user from 62.169.20.73 port 33572 ssh2
Sep 13 05:02:53 nativespace-cdp sshd[1314017]: Received disconnect from 62.169.20.73 port 33572:11: Bye Bye [preauth]
Sep 13 05:02:53 nativespace-cdp sshd[1314017]: Disconnected from 62.169.20.73 port 33572 [preauth]
Sep 13 05:02:55 nativespace-cdp sshd[1314022]: Failed password for root from 103.44.61.94 port 59576 ssh2
Sep 13 05:02:55 nativespace-cdp sshd[1314022]: Received disconnect from 103.44.61.94 port 59576:11: Bye Bye [preauth]
Sep 13 05:02:55 nativespace-cdp sshd[1314022]: Disconnected from 103.44.61.94 port 59576 [preauth]
Sep 13 05:03:09 nativespace-cdp sudo[1314031]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 05:03:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 13 05:03:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 05:03:25 nativespace-cdp sudo[1314355]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 05:03:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 13 05:03:25 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 13 05:03:25 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 13 05:03:25 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:03:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 05:03:25 nativespace-cdp sudo[1314361]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 05:03:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 13 05:03:25 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 13 05:03:25 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 13 05:03:25 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 13 05:03:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 05:03:25 nativespace-cdp sudo[1314367]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 05:03:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 13 05:03:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:03:28 nativespace-cdp sudo[1314407]: pam_unix(sudo:session): session closed for user root
Sep 13 05:03:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep 13 05:03:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:03:30 nativespace-cdp sudo[1314413]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 13 05:04:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 13 05:04:03 nativespace-cdp sudo[1314880]: pam_unix(sudo:session): session closed for user fortunaz
Sep 13 05:04:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep 13 05:04:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:04 nativespace-cdp sudo[1314886]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep 13 05:04:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:04 nativespace-cdp sudo[1314892]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 13 05:04:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:04 nativespace-cdp sudo[1314896]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep 13 05:04:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:07 nativespace-cdp sudo[1314918]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep 13 05:04:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:07 nativespace-cdp sudo[1314923]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep 13 05:04:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:12 nativespace-cdp sudo[1314988]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=isleofwi WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "WooCommerce" on ONE | OAR (https://oneoar.co.uk). Installed version: 8.0.2. Available version: 9.3.1.<br/><br/>2. Plugin "WP Activity Log" on Fortuna Zingara (https://fortunazingara.com). Installed version: 5.2.0. Available version: 5.2.1.<br/><br/>' installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass
Sep 13 05:04:22 nativespace-cdp sudo: wp-toolkit : (command continued) --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep 13 05:04:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:22 nativespace-cdp sudo[1315176]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:38 nativespace-cdp sshd[1315289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.53.29.209  user=root
Sep 13 05:04:38 nativespace-cdp sshd[1315289]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 05:04:40 nativespace-cdp sshd[1315289]: Failed password for root from 161.53.29.209 port 35864 ssh2
Sep 13 05:04:40 nativespace-cdp sshd[1315289]: Received disconnect from 161.53.29.209 port 35864:11: Bye Bye [preauth]
Sep 13 05:04:40 nativespace-cdp sshd[1315289]: Disconnected from 161.53.29.209 port 35864 [preauth]
Sep 13 05:04:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep 13 05:04:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:45 nativespace-cdp sudo[1315348]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315351]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315355]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315358]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315361]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315365]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315368]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315372]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315375]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315378]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:46 nativespace-cdp sudo[1315381]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315384]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315387]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315390]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315393]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315396]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315399]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315402]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315406]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315409]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315412]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315415]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315419]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315423]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315426]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315429]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315432]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315435]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315438]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315441]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315444]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315447]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315450]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315453]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315456]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315459]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315462]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315465]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:47 nativespace-cdp sudo[1315468]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315471]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315474]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315477]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315480]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315483]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315486]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315489]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315492]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315495]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315498]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315501]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315504]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315507]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315511]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315514]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315518]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315521]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315524]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315527]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315530]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315533]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315535]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315538]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315541]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315544]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315547]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315550]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315553]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315556]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:48 nativespace-cdp sudo[1315559]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315562]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315565]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315568]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315571]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315574]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315577]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315580]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315583]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315586]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315589]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315592]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315595]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315598]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315602]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315605]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315608]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315611]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315614]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315617]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315620]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315623]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315626]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315629]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315632]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315635]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315638]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315641]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315644]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315647]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:49 nativespace-cdp sudo[1315650]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315653]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315657]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315660]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315663]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315666]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315669]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315672]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315675]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315678]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315681]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315684]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315687]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315691]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315694]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315697]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315700]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315703]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315706]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315709]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315712]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315715]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315718]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315721]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315724]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315727]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315730]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315733]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315736]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315739]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315742]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315745]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315748]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315751]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 13 05:04:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:50 nativespace-cdp sudo[1315755]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315758]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315761]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315764]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315767]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315770]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315773]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315776]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315779]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315782]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315785]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315788]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315791]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315795]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315798]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315801]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315804]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315807]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315811]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315814]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315817]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315820]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315823]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315826]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315829]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315832]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315835]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315838]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315841]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315844]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315847]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315851]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315854]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315857]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315860]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315863]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315866]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315869]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:51 nativespace-cdp sudo[1315872]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 13 05:04:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315877]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315880]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315884]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315887]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315890]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315893]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315896]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315900]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315904]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315907]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315910]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315913]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315916]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315920]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315923]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315926]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315929]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315932]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315936]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315939]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315942]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315945]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315948]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315951]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315954]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315957]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315960]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315963]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315966]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315969]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315972]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315975]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315978]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 13 05:04:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:52 nativespace-cdp sudo[1315981]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1315984]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1315987]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1315990]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1315993]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1315996]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1315999]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316002]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316005]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316008]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316011]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316014]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316017]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316020]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316023]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316026]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316029]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316032]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316036]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316039]: pam_unix(sudo:session): session closed for user root
Sep 13 05:04:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 13 05:04:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:04:53 nativespace-cdp sudo[1316043]: pam_unix(sudo:session): session closed for user root
Sep 13 05:05:04 nativespace-cdp sshd[1316150]: Invalid user weblogic from 103.107.91.91 port 49040
Sep 13 05:05:04 nativespace-cdp sshd[1316150]: input_userauth_request: invalid user weblogic [preauth]
Sep 13 05:05:04 nativespace-cdp sshd[1316150]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:05:04 nativespace-cdp sshd[1316150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.107.91.91
Sep 13 05:05:07 nativespace-cdp sshd[1316150]: Failed password for invalid user weblogic from 103.107.91.91 port 49040 ssh2
Sep 13 05:05:07 nativespace-cdp sshd[1316150]: Received disconnect from 103.107.91.91 port 49040:11: Bye Bye [preauth]
Sep 13 05:05:07 nativespace-cdp sshd[1316150]: Disconnected from 103.107.91.91 port 49040 [preauth]
Sep 13 05:05:22 nativespace-cdp sshd[1316255]: Invalid user user from 161.53.29.209 port 46386
Sep 13 05:05:22 nativespace-cdp sshd[1316255]: input_userauth_request: invalid user user [preauth]
Sep 13 05:05:22 nativespace-cdp sshd[1316255]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:05:22 nativespace-cdp sshd[1316255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.53.29.209
Sep 13 05:05:25 nativespace-cdp sshd[1316255]: Failed password for invalid user user from 161.53.29.209 port 46386 ssh2
Sep 13 05:05:25 nativespace-cdp sshd[1316255]: Received disconnect from 161.53.29.209 port 46386:11: Bye Bye [preauth]
Sep 13 05:05:25 nativespace-cdp sshd[1316255]: Disconnected from 161.53.29.209 port 46386 [preauth]
Sep 13 05:05:26 nativespace-cdp sshd[1316263]: Invalid user deployer from 103.44.61.94 port 43082
Sep 13 05:05:26 nativespace-cdp sshd[1316263]: input_userauth_request: invalid user deployer [preauth]
Sep 13 05:05:26 nativespace-cdp sshd[1316263]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:05:26 nativespace-cdp sshd[1316263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.44.61.94
Sep 13 05:05:28 nativespace-cdp sshd[1316263]: Failed password for invalid user deployer from 103.44.61.94 port 43082 ssh2
Sep 13 05:05:28 nativespace-cdp sshd[1316263]: Received disconnect from 103.44.61.94 port 43082:11: Bye Bye [preauth]
Sep 13 05:05:28 nativespace-cdp sshd[1316263]: Disconnected from 103.44.61.94 port 43082 [preauth]
Sep 13 05:06:15 nativespace-cdp sshd[1316417]: Invalid user samir from 103.107.91.91 port 52424
Sep 13 05:06:15 nativespace-cdp sshd[1316417]: input_userauth_request: invalid user samir [preauth]
Sep 13 05:06:15 nativespace-cdp sshd[1316417]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:06:15 nativespace-cdp sshd[1316417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.107.91.91
Sep 13 05:06:17 nativespace-cdp sshd[1316417]: Failed password for invalid user samir from 103.107.91.91 port 52424 ssh2
Sep 13 05:06:17 nativespace-cdp sshd[1316417]: Received disconnect from 103.107.91.91 port 52424:11: Bye Bye [preauth]
Sep 13 05:06:17 nativespace-cdp sshd[1316417]: Disconnected from 103.107.91.91 port 52424 [preauth]
Sep 13 05:06:28 nativespace-cdp sshd[1316467]: Connection closed by 103.44.61.94 port 47746 [preauth]
Sep 13 05:06:33 nativespace-cdp sshd[1316502]: Connection closed by 159.100.136.21 port 46126 [preauth]
Sep 13 05:06:40 nativespace-cdp sshd[1316525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.57.102.149  user=root
Sep 13 05:06:40 nativespace-cdp sshd[1316525]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 05:06:42 nativespace-cdp sshd[1316525]: Failed password for root from 151.57.102.149 port 54921 ssh2
Sep 13 05:06:43 nativespace-cdp sshd[1316525]: Received disconnect from 151.57.102.149 port 54921:11: Bye Bye [preauth]
Sep 13 05:06:43 nativespace-cdp sshd[1316525]: Disconnected from 151.57.102.149 port 54921 [preauth]
Sep 13 05:07:05 nativespace-cdp sshd[1316599]: Invalid user rupert from 20.113.181.175 port 42250
Sep 13 05:07:05 nativespace-cdp sshd[1316599]: input_userauth_request: invalid user rupert [preauth]
Sep 13 05:07:05 nativespace-cdp sshd[1316599]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:07:05 nativespace-cdp sshd[1316599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.113.181.175
Sep 13 05:07:06 nativespace-cdp sshd[1316599]: Failed password for invalid user rupert from 20.113.181.175 port 42250 ssh2
Sep 13 05:07:06 nativespace-cdp sshd[1316599]: Received disconnect from 20.113.181.175 port 42250:11: Bye Bye [preauth]
Sep 13 05:07:06 nativespace-cdp sshd[1316599]: Disconnected from 20.113.181.175 port 42250 [preauth]
Sep 13 05:07:20 nativespace-cdp sshd[1316634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.44.61.94  user=root
Sep 13 05:07:20 nativespace-cdp sshd[1316634]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 05:07:21 nativespace-cdp sshd[1316634]: Failed password for root from 103.44.61.94 port 48914 ssh2
Sep 13 05:07:22 nativespace-cdp sshd[1316634]: Received disconnect from 103.44.61.94 port 48914:11: Bye Bye [preauth]
Sep 13 05:07:22 nativespace-cdp sshd[1316634]: Disconnected from 103.44.61.94 port 48914 [preauth]
Sep 13 05:07:34 nativespace-cdp sshd[1316689]: Invalid user shiny from 151.57.102.149 port 54311
Sep 13 05:07:34 nativespace-cdp sshd[1316689]: input_userauth_request: invalid user shiny [preauth]
Sep 13 05:07:34 nativespace-cdp sshd[1316689]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:07:34 nativespace-cdp sshd[1316689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.57.102.149
Sep 13 05:07:36 nativespace-cdp sshd[1316689]: Failed password for invalid user shiny from 151.57.102.149 port 54311 ssh2
Sep 13 05:07:44 nativespace-cdp sshd[1316751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.113.181.175  user=root
Sep 13 05:07:44 nativespace-cdp sshd[1316751]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 05:07:46 nativespace-cdp sshd[1316751]: Failed password for root from 20.113.181.175 port 46566 ssh2
Sep 13 05:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 05:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:38 nativespace-cdp sudo[1317205]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 05:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:39 nativespace-cdp sudo[1317210]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 05:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:46 nativespace-cdp sudo[1317214]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 05:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:46 nativespace-cdp sudo[1317238]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 05:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:49 nativespace-cdp sudo[1317241]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:49 nativespace-cdp sudo[1317251]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:49 nativespace-cdp sudo[1317254]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:49 nativespace-cdp sudo[1317257]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 05:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:49 nativespace-cdp sudo[1317260]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 05:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:50 nativespace-cdp sudo[1317263]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 05:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:50 nativespace-cdp sudo[1317266]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 05:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:09:55 nativespace-cdp sudo[1317290]: pam_unix(sudo:session): session closed for user root
Sep 13 05:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 05:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:10:00 nativespace-cdp sudo[1317295]: pam_unix(sudo:session): session closed for user root
Sep 13 05:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=dickemery123 user-3=ptkxhsbt user-4=hhdugcor user-5=lbhyisi user-6=magichat user-7=brmrjxl user-8=lakesan1 user-9=strathar user-10=atestord user-11=sarafoundation user-12=wilsonsw user-13=megacards user-14=musorguk user-15=jarvisin user-16=spectrum user-17=theblack user-18=hodgesonweb user-19=agproduc user-20=still user-21=stephani user-22=leereyn1 user-23=markward user-24=foundation user-25=booff user-26=vantagep user-27=athenare user-28=connect9 user-29=lbscrmod user-30=maflemin user-31=ulsukarm user-32=alexadmin user-33=skyfirec user-34=innovat1 user-35=stuartge user-36=askhform user-37=nativene user-38=nstriton user-39=brighto1 user-40=vivienn1 user-41=firstre2 user-42=oneoarco user-43=battlere user-44=bedfords user-45=newstoda user-46=ggaaorgu user-47=belle user-48=bemadonn
Sep 13 05:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=gilpin user-50=milloyco user-51=elecleis user-52=hubmaster user-53=putterfi user-54=fetch user-55=carsinyo user-56=accooper user-57=ianrayne user-58=connectedshoppin user-59=thqkgnbz user-60=ultbcrra user-61=seftvta user-62=jonhartl user-63=firstres user-64=coursemc user-65=opaiscyx user-66=firstrel user-67=clarkass user-68=costestimatorco user-69=firstred user-70=highlegh user-71=southlon user-72=cathski user-73=cambria1 user-74=ninejimm user-75=reliable user-76=cwsocial user-77=paulmca1 user-78=howardon user-79=pugwash user-80=hirefootballgame user-81=eugincou user-82=courseme user-83=nscdp user-84=putterfc user-85=leftie user-86=foods user-87=health2045 user-88=fortunaz user-89=lkpier user-90=firstre5 user-91=donnychicago user-92=steakbridieme user-93=philmcph user-94=ctedorgu user-95=smrszyqg user-96=isleofwi user-97=nomistakes user-98=hidden user-99=barbersh user-100=tigerlet user-101=fawcettd
Sep 13 05:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=burydropin user-103=nsceres user-104=beauty user-105=darkstar user-106=eatspam user-107=dhyana user-108=asandcoc user-109=sibtoncc user-110=bwppodcast user-111=zebrapho user-112=steve user-113=oubpgvbx user-114=tstardom user-115=what user-116=havantho user-117=sketchy user-118=cath user-119=nvihkvu user-120=stagingerris user-121=dancinggardener user-122=ladburyp user-123=kategilpin user-124=design user-125=nove user-126=boldover user-127=bakery user-128=crrtipdl user-129=sosevalu user-130=lucy user-131=attlebor user-132=onlycont user-133=ranxterc user-134=outdoorc user-135=hodgsonmail user-136=branko user-137=romaldki user-138=tomandle user-139=jennimil user-140=chrisdal user-141=mcdermos user-142=david user-143=nbhavers user-144=careers feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 05:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 05:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:10:01 nativespace-cdp sudo[1317305]: pam_unix(sudo:session): session closed for user root
Sep 13 05:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 05:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:10:04 nativespace-cdp sudo[1317422]: pam_unix(sudo:session): session closed for user root
Sep 13 05:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DyaSnLM2kaOIr8oj.~
Sep 13 05:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:10:04 nativespace-cdp sudo[1317429]: pam_unix(sudo:session): session closed for user root
Sep 13 05:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DyaSnLM2kaOIr8oj.~'
Sep 13 05:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:10:04 nativespace-cdp sudo[1317432]: pam_unix(sudo:session): session closed for user root
Sep 13 05:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-DyaSnLM2kaOIr8oj.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 05:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:10:05 nativespace-cdp sudo[1317437]: pam_unix(sudo:session): session closed for user root
Sep 13 05:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 05:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:10:05 nativespace-cdp sudo[1317441]: pam_unix(sudo:session): session closed for user root
Sep 13 05:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 05:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 05:10:08 nativespace-cdp sudo[1317475]: pam_unix(sudo:session): session closed for user root
Sep 13 05:10:24 nativespace-cdp sshd[1317528]: Invalid user michael from 62.169.20.73 port 39802
Sep 13 05:10:24 nativespace-cdp sshd[1317528]: input_userauth_request: invalid user michael [preauth]
Sep 13 05:10:24 nativespace-cdp sshd[1317528]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:10:24 nativespace-cdp sshd[1317528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.169.20.73
Sep 13 05:10:26 nativespace-cdp sshd[1317528]: Failed password for invalid user michael from 62.169.20.73 port 39802 ssh2
Sep 13 05:10:26 nativespace-cdp sshd[1317528]: Received disconnect from 62.169.20.73 port 39802:11: Bye Bye [preauth]
Sep 13 05:10:26 nativespace-cdp sshd[1317528]: Disconnected from 62.169.20.73 port 39802 [preauth]
Sep 13 05:11:07 nativespace-cdp sshd[1317726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.169.20.73  user=root
Sep 13 05:11:07 nativespace-cdp sshd[1317726]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 05:11:08 nativespace-cdp sshd[1317726]: Failed password for root from 62.169.20.73 port 46874 ssh2
Sep 13 05:11:08 nativespace-cdp sshd[1317726]: Received disconnect from 62.169.20.73 port 46874:11: Bye Bye [preauth]
Sep 13 05:11:08 nativespace-cdp sshd[1317726]: Disconnected from 62.169.20.73 port 46874 [preauth]
Sep 13 05:11:24 nativespace-cdp sshd[1317812]: Did not receive identification string from 182.93.50.90 port 35290
Sep 13 05:11:33 nativespace-cdp sshd[1317841]: Connection closed by 159.100.136.21 port 54842 [preauth]
Sep 13 05:12:30 nativespace-cdp sshd[1318023]: Invalid user weblogic from 182.93.50.90 port 59698
Sep 13 05:12:30 nativespace-cdp sshd[1318023]: input_userauth_request: invalid user weblogic [preauth]
Sep 13 05:12:31 nativespace-cdp sshd[1318023]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:12:31 nativespace-cdp sshd[1318023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.93.50.90
Sep 13 05:12:33 nativespace-cdp sshd[1318023]: Failed password for invalid user weblogic from 182.93.50.90 port 59698 ssh2
Sep 13 05:12:35 nativespace-cdp sshd[1318023]: Received disconnect from 182.93.50.90 port 59698:11: Bye Bye [preauth]
Sep 13 05:12:35 nativespace-cdp sshd[1318023]: Disconnected from 182.93.50.90 port 59698 [preauth]
Sep 13 05:16:14 nativespace-cdp sshd[1319019]: Invalid user myuser from 200.129.17.4 port 50716
Sep 13 05:16:14 nativespace-cdp sshd[1319019]: input_userauth_request: invalid user myuser [preauth]
Sep 13 05:16:14 nativespace-cdp sshd[1319019]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:16:14 nativespace-cdp sshd[1319019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.129.17.4
Sep 13 05:16:16 nativespace-cdp sshd[1319019]: Failed password for invalid user myuser from 200.129.17.4 port 50716 ssh2
Sep 13 05:16:17 nativespace-cdp sshd[1319019]: Received disconnect from 200.129.17.4 port 50716:11: Bye Bye [preauth]
Sep 13 05:16:17 nativespace-cdp sshd[1319019]: Disconnected from 200.129.17.4 port 50716 [preauth]
Sep 13 05:16:33 nativespace-cdp sshd[1319093]: Invalid user teste from 216.225.201.227 port 42392
Sep 13 05:16:33 nativespace-cdp sshd[1319093]: input_userauth_request: invalid user teste [preauth]
Sep 13 05:16:33 nativespace-cdp sshd[1319097]: Connection closed by 159.100.136.21 port 36076 [preauth]
Sep 13 05:16:33 nativespace-cdp sshd[1319093]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:16:33 nativespace-cdp sshd[1319093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.225.201.227
Sep 13 05:16:35 nativespace-cdp sshd[1319093]: Failed password for invalid user teste from 216.225.201.227 port 42392 ssh2
Sep 13 05:16:35 nativespace-cdp sshd[1319093]: Received disconnect from 216.225.201.227 port 42392:11: Bye Bye [preauth]
Sep 13 05:16:35 nativespace-cdp sshd[1319093]: Disconnected from 216.225.201.227 port 42392 [preauth]
Sep 13 05:19:57 nativespace-cdp sshd[1319790]: Invalid user user from 152.67.77.119 port 60280
Sep 13 05:19:57 nativespace-cdp sshd[1319790]: input_userauth_request: invalid user user [preauth]
Sep 13 05:19:57 nativespace-cdp sshd[1319790]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:19:57 nativespace-cdp sshd[1319790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.67.77.119
Sep 13 05:19:59 nativespace-cdp sshd[1319790]: Failed password for invalid user user from 152.67.77.119 port 60280 ssh2
Sep 13 05:20:09 nativespace-cdp sshd[1319790]: Received disconnect from 152.67.77.119 port 60280:11: Bye Bye [preauth]
Sep 13 05:20:09 nativespace-cdp sshd[1319790]: Disconnected from 152.67.77.119 port 60280 [preauth]
Sep 13 05:21:33 nativespace-cdp sshd[1320232]: Connection closed by 159.100.136.21 port 45262 [preauth]
Sep 13 05:22:20 nativespace-cdp sshd[1320442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.74.85.237  user=root
Sep 13 05:22:20 nativespace-cdp sshd[1320442]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 05:22:22 nativespace-cdp sshd[1320442]: Failed password for root from 97.74.85.237 port 38336 ssh2
Sep 13 05:22:23 nativespace-cdp sshd[1320442]: Received disconnect from 97.74.85.237 port 38336:11: Bye Bye [preauth]
Sep 13 05:22:23 nativespace-cdp sshd[1320442]: Disconnected from 97.74.85.237 port 38336 [preauth]
Sep 13 05:22:47 nativespace-cdp sshd[1320516]: Invalid user amirrr from 216.225.201.227 port 44408
Sep 13 05:22:47 nativespace-cdp sshd[1320516]: input_userauth_request: invalid user amirrr [preauth]
Sep 13 05:22:47 nativespace-cdp sshd[1320516]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:22:47 nativespace-cdp sshd[1320516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.225.201.227
Sep 13 05:22:49 nativespace-cdp sshd[1320516]: Failed password for invalid user amirrr from 216.225.201.227 port 44408 ssh2
Sep 13 05:22:49 nativespace-cdp sshd[1320516]: Received disconnect from 216.225.201.227 port 44408:11: Bye Bye [preauth]
Sep 13 05:22:49 nativespace-cdp sshd[1320516]: Disconnected from 216.225.201.227 port 44408 [preauth]
Sep 13 05:22:58 nativespace-cdp sshd[1320537]: Invalid user test from 200.129.17.4 port 37616
Sep 13 05:22:58 nativespace-cdp sshd[1320537]: input_userauth_request: invalid user test [preauth]
Sep 13 05:22:58 nativespace-cdp sshd[1320537]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:22:58 nativespace-cdp sshd[1320537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.129.17.4
Sep 13 05:23:01 nativespace-cdp sshd[1320537]: Failed password for invalid user test from 200.129.17.4 port 37616 ssh2
Sep 13 05:23:01 nativespace-cdp sshd[1320537]: Received disconnect from 200.129.17.4 port 37616:11: Bye Bye [preauth]
Sep 13 05:23:01 nativespace-cdp sshd[1320537]: Disconnected from 200.129.17.4 port 37616 [preauth]
Sep 13 05:23:34 nativespace-cdp sshd[1320638]: Invalid user vhserver from 216.225.201.227 port 35668
Sep 13 05:23:34 nativespace-cdp sshd[1320638]: input_userauth_request: invalid user vhserver [preauth]
Sep 13 05:23:34 nativespace-cdp sshd[1320638]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:23:34 nativespace-cdp sshd[1320638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.225.201.227
Sep 13 05:23:37 nativespace-cdp sshd[1320638]: Failed password for invalid user vhserver from 216.225.201.227 port 35668 ssh2
Sep 13 05:23:37 nativespace-cdp sshd[1320638]: Received disconnect from 216.225.201.227 port 35668:11: Bye Bye [preauth]
Sep 13 05:23:37 nativespace-cdp sshd[1320638]: Disconnected from 216.225.201.227 port 35668 [preauth]
Sep 13 05:23:52 nativespace-cdp sshd[1320786]: Invalid user dev from 200.129.17.4 port 49728
Sep 13 05:23:52 nativespace-cdp sshd[1320786]: input_userauth_request: invalid user dev [preauth]
Sep 13 05:23:52 nativespace-cdp sshd[1320786]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:23:52 nativespace-cdp sshd[1320786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.129.17.4
Sep 13 05:23:55 nativespace-cdp sshd[1320786]: Failed password for invalid user dev from 200.129.17.4 port 49728 ssh2
Sep 13 05:23:55 nativespace-cdp sshd[1320786]: Received disconnect from 200.129.17.4 port 49728:11: Bye Bye [preauth]
Sep 13 05:23:55 nativespace-cdp sshd[1320786]: Disconnected from 200.129.17.4 port 49728 [preauth]
Sep 13 05:24:17 nativespace-cdp sshd[1320930]: Received disconnect from 97.74.85.237 port 35196:11: Bye Bye [preauth]
Sep 13 05:24:17 nativespace-cdp sshd[1320930]: Disconnected from 97.74.85.237 port 35196 [preauth]
Sep 13 05:25:09 nativespace-cdp sshd[1321148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.74.85.237  user=root
Sep 13 05:25:09 nativespace-cdp sshd[1321148]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 05:25:10 nativespace-cdp sshd[1321148]: Failed password for root from 97.74.85.237 port 53990 ssh2
Sep 13 05:25:10 nativespace-cdp sshd[1321148]: Received disconnect from 97.74.85.237 port 53990:11: Bye Bye [preauth]
Sep 13 05:25:10 nativespace-cdp sshd[1321148]: Disconnected from 97.74.85.237 port 53990 [preauth]
Sep 13 05:25:59 nativespace-cdp sshd[1321315]: Invalid user amirrr from 97.74.85.237 port 35522
Sep 13 05:25:59 nativespace-cdp sshd[1321315]: input_userauth_request: invalid user amirrr [preauth]
Sep 13 05:25:59 nativespace-cdp sshd[1321315]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:25:59 nativespace-cdp sshd[1321315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.74.85.237
Sep 13 05:26:01 nativespace-cdp sshd[1321315]: Failed password for invalid user amirrr from 97.74.85.237 port 35522 ssh2
Sep 13 05:26:01 nativespace-cdp sshd[1321315]: Received disconnect from 97.74.85.237 port 35522:11: Bye Bye [preauth]
Sep 13 05:26:01 nativespace-cdp sshd[1321315]: Disconnected from 97.74.85.237 port 35522 [preauth]
Sep 13 05:26:33 nativespace-cdp sshd[1321734]: Connection closed by 159.100.136.21 port 54618 [preauth]
Sep 13 05:26:52 nativespace-cdp sshd[1321934]: Invalid user user from 152.67.77.119 port 58272
Sep 13 05:26:52 nativespace-cdp sshd[1321934]: input_userauth_request: invalid user user [preauth]
Sep 13 05:26:52 nativespace-cdp sshd[1321934]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:26:52 nativespace-cdp sshd[1321934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.67.77.119
Sep 13 05:26:53 nativespace-cdp sshd[1321934]: Failed password for invalid user user from 152.67.77.119 port 58272 ssh2
Sep 13 05:26:53 nativespace-cdp sshd[1321934]: Received disconnect from 152.67.77.119 port 58272:11: Bye Bye [preauth]
Sep 13 05:26:53 nativespace-cdp sshd[1321934]: Disconnected from 152.67.77.119 port 58272 [preauth]
Sep 13 05:29:14 nativespace-cdp sshd[1322687]: Invalid user vhserver from 152.67.77.119 port 57660
Sep 13 05:29:14 nativespace-cdp sshd[1322687]: input_userauth_request: invalid user vhserver [preauth]
Sep 13 05:29:14 nativespace-cdp sshd[1322687]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 05:29:14 nativespace-cdp sshd[1322687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.67.77.119
Sep 13 05:29:16 nativespace-cdp sshd[1322687]: Failed password for invalid user vhserver from 152.67.77.119 port 57660 ssh2
Sep 13 05:29:17 nativespace-cdp sshd[1322687]: Received disconnect from 152.67.77.119 port 57660:11: Bye Bye [preauth]
Sep 13 05:29:17 nativespace-cdp sshd[1322687]: Disconnected from 152.67.77.119 port 57660 [preauth]
Sep 13 05:31:33 nativespace-cdp sshd[1323257]: Connection closed by 159.100.136.21 port 35278 [preauth]
Sep 13 05:35:23 nativespace-cdp su: pam_unix(su:session): session opened for user coursemc by (uid=0)
Sep 13 05:35:24 nativespace-cdp su[1324103]: pam_unix(su:session): session closed for user coursemc
Sep 13 05:36:34 nativespace-cdp sshd[1324359]: Connection closed by 159.100.136.21 port 43968 [preauth]
Sep 13 05:41:33 nativespace-cdp sshd[1325515]: Connection closed by 159.100.136.21 port 52114 [preauth]
Sep 13 05:46:34 nativespace-cdp sshd[1326900]: Connection closed by 159.100.136.21 port 32864 [preauth]
Sep 13 05:51:33 nativespace-cdp sshd[1328246]: Connection closed by 159.100.136.21 port 40414 [preauth]
Sep 13 05:56:33 nativespace-cdp sshd[1329386]: Connection closed by 159.100.136.21 port 49468 [preauth]
Sep 13 06:01:35 nativespace-cdp sshd[1330835]: Connection closed by 159.100.136.21 port 56596 [preauth]
Sep 13 06:06:35 nativespace-cdp sshd[1331842]: Connection closed by 159.100.136.21 port 38340 [preauth]
Sep 13 06:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 06:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:39 nativespace-cdp sudo[1332465]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 06:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:39 nativespace-cdp sudo[1332470]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 06:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:42 nativespace-cdp sudo[1332473]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 06:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:42 nativespace-cdp sudo[1332489]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 06:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:46 nativespace-cdp sudo[1332493]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:46 nativespace-cdp sudo[1332506]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:46 nativespace-cdp sudo[1332509]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:46 nativespace-cdp sudo[1332512]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:46 nativespace-cdp sudo[1332515]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 06:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:46 nativespace-cdp sudo[1332518]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 06:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:47 nativespace-cdp sudo[1332521]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 06:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:49 nativespace-cdp sudo[1332532]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 06:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:55 nativespace-cdp sudo[1332536]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=stephani user-2=leereyn1 user-3=agproduc user-4=still user-5=spectrum user-6=theblack user-7=hodgesonweb user-8=jarvisin user-9=ulsukarm user-10=vantagep user-11=athenare user-12=connect9 user-13=lbscrmod user-14=maflemin user-15=markward user-16=booff user-17=foundation user-18=magichat user-19=hhdugcor user-20=lbhyisi user-21=dickemery123 user-22=ptkxhsbt user-23=martsblo user-24=megacards user-25=musorguk user-26=wilsonsw user-27=strathar user-28=atestord user-29=sarafoundation user-30=brmrjxl user-31=lakesan1 user-32=connectedshoppin user-33=thqkgnbz user-34=accooper user-35=ianrayne user-36=putterfi user-37=hubmaster user-38=fetch user-39=carsinyo user-40=gilpin user-41=milloyco user-42=elecleis user-43=firstred user-44=highlegh user-45=southlon user-46=firstrel user-47=clarkass
Sep 13 06:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=costestimatorco user-49=coursemc user-50=opaiscyx user-51=ultbcrra user-52=jonhartl user-53=seftvta user-54=firstres user-55=nativene user-56=innovat1 user-57=askhform user-58=stuartge user-59=alexadmin user-60=skyfirec user-61=newstoda user-62=ggaaorgu user-63=belle user-64=bemadonn user-65=bedfords user-66=vivienn1 user-67=firstre2 user-68=oneoarco user-69=battlere user-70=nstriton user-71=brighto1 user-72=dhyana user-73=beauty user-74=darkstar user-75=eatspam user-76=nsceres user-77=fawcettd user-78=burydropin user-79=steve user-80=bwppodcast user-81=zebrapho user-82=asandcoc user-83=sibtoncc user-84=eugincou user-85=courseme user-86=hirefootballgame user-87=cwsocial user-88=howardon user-89=pugwash user-90=paulmca1 user-91=cathski user-92=cambria1 user-93=reliable user-94=ninejimm user-95=nomistakes user-96=hidden user-97=barbersh user-98=tigerlet user-99=isleofwi user-100=smrszyqg user-101=lkpier
Sep 13 06:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=donnychicago user-103=steakbridieme user-104=firstre5 user-105=philmcph user-106=ctedorgu user-107=nscdp user-108=putterfc user-109=foods user-110=leftie user-111=fortunaz user-112=health2045 user-113=romaldki user-114=outdoorc user-115=hodgsonmail user-116=ranxterc user-117=branko user-118=onlycont user-119=lucy user-120=attlebor user-121=david user-122=nbhavers user-123=careers user-124=chrisdal user-125=mcdermos user-126=jennimil user-127=tomandle user-128=design user-129=dancinggardener user-130=stagingerris user-131=ladburyp user-132=kategilpin user-133=havantho user-134=cath user-135=sketchy user-136=nvihkvu user-137=oubpgvbx user-138=tstardom user-139=what user-140=bakery user-141=crrtipdl user-142=sosevalu user-143=boldover user-144=nove feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 06:09:55 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 06:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:56 nativespace-cdp sudo[1332554]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:57 nativespace-cdp sudo[1332562]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rNXMwjvMK9rE1cwA.~
Sep 13 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:57 nativespace-cdp sudo[1332565]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rNXMwjvMK9rE1cwA.~'
Sep 13 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:57 nativespace-cdp sudo[1332568]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rNXMwjvMK9rE1cwA.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:57 nativespace-cdp sudo[1332572]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 06:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:57 nativespace-cdp sudo[1332575]: pam_unix(sudo:session): session closed for user root
Sep 13 06:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 06:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 06:09:59 nativespace-cdp sudo[1332600]: pam_unix(sudo:session): session closed for user root
Sep 13 06:11:33 nativespace-cdp sshd[1333142]: Connection closed by 159.100.136.21 port 46280 [preauth]
Sep 13 06:16:34 nativespace-cdp sshd[1334708]: Connection closed by 159.100.136.21 port 55402 [preauth]
Sep 13 06:26:34 nativespace-cdp sshd[1337005]: Connection closed by 159.100.136.21 port 45588 [preauth]
Sep 13 06:31:33 nativespace-cdp sshd[1338496]: Connection closed by 159.100.136.21 port 54516 [preauth]
Sep 13 06:34:46 nativespace-cdp sshd[1339202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.233.250.87  user=root
Sep 13 06:34:46 nativespace-cdp sshd[1339202]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 06:34:48 nativespace-cdp sshd[1339202]: Failed password for root from 35.233.250.87 port 58818 ssh2
Sep 13 06:34:48 nativespace-cdp sshd[1339202]: Received disconnect from 35.233.250.87 port 58818:11: Bye Bye [preauth]
Sep 13 06:34:48 nativespace-cdp sshd[1339202]: Disconnected from 35.233.250.87 port 58818 [preauth]
Sep 13 06:36:24 nativespace-cdp sshd[1339621]: Invalid user postgres from 27.112.78.61 port 41098
Sep 13 06:36:24 nativespace-cdp sshd[1339621]: input_userauth_request: invalid user postgres [preauth]
Sep 13 06:36:24 nativespace-cdp sshd[1339621]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:36:24 nativespace-cdp sshd[1339621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.112.78.61
Sep 13 06:36:26 nativespace-cdp sshd[1339621]: Failed password for invalid user postgres from 27.112.78.61 port 41098 ssh2
Sep 13 06:36:33 nativespace-cdp sshd[1339640]: Connection closed by 159.100.136.21 port 36048 [preauth]
Sep 13 06:37:12 nativespace-cdp sshd[1339750]: Invalid user administrator1 from 54.37.153.81 port 44250
Sep 13 06:37:12 nativespace-cdp sshd[1339750]: input_userauth_request: invalid user administrator1 [preauth]
Sep 13 06:37:12 nativespace-cdp sshd[1339750]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:37:12 nativespace-cdp sshd[1339750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.153.81
Sep 13 06:37:13 nativespace-cdp sshd[1339750]: Failed password for invalid user administrator1 from 54.37.153.81 port 44250 ssh2
Sep 13 06:37:13 nativespace-cdp sshd[1339750]: Received disconnect from 54.37.153.81 port 44250:11: Bye Bye [preauth]
Sep 13 06:37:13 nativespace-cdp sshd[1339750]: Disconnected from 54.37.153.81 port 44250 [preauth]
Sep 13 06:37:17 nativespace-cdp sshd[1339621]: Received disconnect from 27.112.78.61 port 41098:11: Bye Bye [preauth]
Sep 13 06:37:17 nativespace-cdp sshd[1339621]: Disconnected from 27.112.78.61 port 41098 [preauth]
Sep 13 06:39:22 nativespace-cdp sshd[1340197]: Did not receive identification string from 167.94.146.52 port 53544
Sep 13 06:39:41 nativespace-cdp sshd[1340214]: Connection closed by 167.94.146.52 port 52672 [preauth]
Sep 13 06:40:20 nativespace-cdp sshd[1340472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.222.90  user=root
Sep 13 06:40:20 nativespace-cdp sshd[1340472]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 06:40:22 nativespace-cdp sshd[1340472]: Failed password for root from 202.29.222.90 port 34740 ssh2
Sep 13 06:40:22 nativespace-cdp sshd[1340472]: Received disconnect from 202.29.222.90 port 34740:11: Bye Bye [preauth]
Sep 13 06:40:22 nativespace-cdp sshd[1340472]: Disconnected from 202.29.222.90 port 34740 [preauth]
Sep 13 06:40:54 nativespace-cdp sshd[1340640]: Invalid user ubuntu from 35.233.250.87 port 46246
Sep 13 06:40:54 nativespace-cdp sshd[1340640]: input_userauth_request: invalid user ubuntu [preauth]
Sep 13 06:40:54 nativespace-cdp sshd[1340640]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:40:54 nativespace-cdp sshd[1340640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.233.250.87
Sep 13 06:40:56 nativespace-cdp sshd[1340640]: Failed password for invalid user ubuntu from 35.233.250.87 port 46246 ssh2
Sep 13 06:40:57 nativespace-cdp sshd[1340640]: Received disconnect from 35.233.250.87 port 46246:11: Bye Bye [preauth]
Sep 13 06:40:57 nativespace-cdp sshd[1340640]: Disconnected from 35.233.250.87 port 46246 [preauth]
Sep 13 06:41:10 nativespace-cdp sshd[1340734]: Invalid user postgres from 54.37.153.81 port 40754
Sep 13 06:41:10 nativespace-cdp sshd[1340734]: input_userauth_request: invalid user postgres [preauth]
Sep 13 06:41:10 nativespace-cdp sshd[1340734]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:41:10 nativespace-cdp sshd[1340734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.153.81
Sep 13 06:41:12 nativespace-cdp sshd[1340734]: Failed password for invalid user postgres from 54.37.153.81 port 40754 ssh2
Sep 13 06:41:12 nativespace-cdp sshd[1340734]: Received disconnect from 54.37.153.81 port 40754:11: Bye Bye [preauth]
Sep 13 06:41:12 nativespace-cdp sshd[1340734]: Disconnected from 54.37.153.81 port 40754 [preauth]
Sep 13 06:41:34 nativespace-cdp sshd[1340870]: Connection closed by 159.100.136.21 port 43828 [preauth]
Sep 13 06:41:34 nativespace-cdp sshd[1340866]: Invalid user postgres from 35.233.250.87 port 51440
Sep 13 06:41:34 nativespace-cdp sshd[1340866]: input_userauth_request: invalid user postgres [preauth]
Sep 13 06:41:34 nativespace-cdp sshd[1340866]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:41:34 nativespace-cdp sshd[1340866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.233.250.87
Sep 13 06:41:36 nativespace-cdp sshd[1340866]: Failed password for invalid user postgres from 35.233.250.87 port 51440 ssh2
Sep 13 06:41:36 nativespace-cdp sshd[1340866]: Received disconnect from 35.233.250.87 port 51440:11: Bye Bye [preauth]
Sep 13 06:41:36 nativespace-cdp sshd[1340866]: Disconnected from 35.233.250.87 port 51440 [preauth]
Sep 13 06:41:49 nativespace-cdp sshd[1340936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.222.90  user=root
Sep 13 06:41:49 nativespace-cdp sshd[1340936]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 06:41:51 nativespace-cdp sshd[1340936]: Failed password for root from 202.29.222.90 port 54146 ssh2
Sep 13 06:41:51 nativespace-cdp sshd[1340936]: Received disconnect from 202.29.222.90 port 54146:11: Bye Bye [preauth]
Sep 13 06:41:51 nativespace-cdp sshd[1340936]: Disconnected from 202.29.222.90 port 54146 [preauth]
Sep 13 06:41:51 nativespace-cdp sshd[1340942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.153.81  user=root
Sep 13 06:41:51 nativespace-cdp sshd[1340942]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 06:41:53 nativespace-cdp sshd[1340942]: Failed password for root from 54.37.153.81 port 60340 ssh2
Sep 13 06:41:53 nativespace-cdp sshd[1340942]: Received disconnect from 54.37.153.81 port 60340:11: Bye Bye [preauth]
Sep 13 06:41:53 nativespace-cdp sshd[1340942]: Disconnected from 54.37.153.81 port 60340 [preauth]
Sep 13 06:42:37 nativespace-cdp sshd[1341109]: Invalid user admin from 202.29.222.90 port 44110
Sep 13 06:42:37 nativespace-cdp sshd[1341109]: input_userauth_request: invalid user admin [preauth]
Sep 13 06:42:37 nativespace-cdp sshd[1341109]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:42:37 nativespace-cdp sshd[1341109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.222.90
Sep 13 06:42:39 nativespace-cdp sshd[1341109]: Failed password for invalid user admin from 202.29.222.90 port 44110 ssh2
Sep 13 06:42:39 nativespace-cdp sshd[1341109]: Received disconnect from 202.29.222.90 port 44110:11: Bye Bye [preauth]
Sep 13 06:42:39 nativespace-cdp sshd[1341109]: Disconnected from 202.29.222.90 port 44110 [preauth]
Sep 13 06:42:48 nativespace-cdp sshd[1341170]: Invalid user guest from 103.150.124.201 port 58608
Sep 13 06:42:48 nativespace-cdp sshd[1341170]: input_userauth_request: invalid user guest [preauth]
Sep 13 06:42:48 nativespace-cdp sshd[1341170]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:42:48 nativespace-cdp sshd[1341170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.150.124.201
Sep 13 06:42:50 nativespace-cdp sshd[1341170]: Failed password for invalid user guest from 103.150.124.201 port 58608 ssh2
Sep 13 06:42:50 nativespace-cdp sshd[1341170]: Received disconnect from 103.150.124.201 port 58608:11: Bye Bye [preauth]
Sep 13 06:42:50 nativespace-cdp sshd[1341170]: Disconnected from 103.150.124.201 port 58608 [preauth]
Sep 13 06:43:12 nativespace-cdp sshd[1341285]: Invalid user user from 27.112.78.61 port 41290
Sep 13 06:43:12 nativespace-cdp sshd[1341285]: input_userauth_request: invalid user user [preauth]
Sep 13 06:43:12 nativespace-cdp sshd[1341285]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:43:12 nativespace-cdp sshd[1341285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.112.78.61
Sep 13 06:43:15 nativespace-cdp sshd[1341285]: Failed password for invalid user user from 27.112.78.61 port 41290 ssh2
Sep 13 06:43:16 nativespace-cdp sshd[1341285]: Received disconnect from 27.112.78.61 port 41290:11: Bye Bye [preauth]
Sep 13 06:43:16 nativespace-cdp sshd[1341285]: Disconnected from 27.112.78.61 port 41290 [preauth]
Sep 13 06:44:06 nativespace-cdp sshd[1341821]: Invalid user gitlab-runner from 27.112.78.61 port 41348
Sep 13 06:44:06 nativespace-cdp sshd[1341821]: input_userauth_request: invalid user gitlab-runner [preauth]
Sep 13 06:44:07 nativespace-cdp sshd[1341821]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:44:07 nativespace-cdp sshd[1341821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.112.78.61
Sep 13 06:44:08 nativespace-cdp sshd[1341821]: Failed password for invalid user gitlab-runner from 27.112.78.61 port 41348 ssh2
Sep 13 06:44:09 nativespace-cdp sshd[1341821]: Received disconnect from 27.112.78.61 port 41348:11: Bye Bye [preauth]
Sep 13 06:44:09 nativespace-cdp sshd[1341821]: Disconnected from 27.112.78.61 port 41348 [preauth]
Sep 13 06:44:45 nativespace-cdp sshd[1342142]: Invalid user ubuntu from 103.150.124.201 port 49760
Sep 13 06:44:45 nativespace-cdp sshd[1342142]: input_userauth_request: invalid user ubuntu [preauth]
Sep 13 06:44:45 nativespace-cdp sshd[1342142]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:44:45 nativespace-cdp sshd[1342142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.150.124.201
Sep 13 06:44:47 nativespace-cdp sshd[1342142]: Failed password for invalid user ubuntu from 103.150.124.201 port 49760 ssh2
Sep 13 06:44:47 nativespace-cdp sshd[1342142]: Received disconnect from 103.150.124.201 port 49760:11: Bye Bye [preauth]
Sep 13 06:44:47 nativespace-cdp sshd[1342142]: Disconnected from 103.150.124.201 port 49760 [preauth]
Sep 13 06:45:40 nativespace-cdp sshd[1342442]: Invalid user admin from 103.150.124.201 port 34564
Sep 13 06:45:40 nativespace-cdp sshd[1342442]: input_userauth_request: invalid user admin [preauth]
Sep 13 06:45:40 nativespace-cdp sshd[1342442]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 06:45:40 nativespace-cdp sshd[1342442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.150.124.201
Sep 13 06:45:42 nativespace-cdp sshd[1342442]: Failed password for invalid user admin from 103.150.124.201 port 34564 ssh2
Sep 13 06:45:44 nativespace-cdp sshd[1342442]: Received disconnect from 103.150.124.201 port 34564:11: Bye Bye [preauth]
Sep 13 06:45:44 nativespace-cdp sshd[1342442]: Disconnected from 103.150.124.201 port 34564 [preauth]
Sep 13 06:46:34 nativespace-cdp sshd[1342611]: Connection closed by 159.100.136.21 port 52578 [preauth]
Sep 13 06:51:33 nativespace-cdp sshd[1343751]: Connection closed by 159.100.136.21 port 33218 [preauth]
Sep 13 06:56:34 nativespace-cdp sshd[1344865]: Connection closed by 159.100.136.21 port 42320 [preauth]
Sep 13 07:01:33 nativespace-cdp sshd[1346526]: Connection closed by 159.100.136.21 port 51064 [preauth]
Sep 13 07:06:34 nativespace-cdp sshd[1347748]: Connection closed by 159.100.136.21 port 58496 [preauth]
Sep 13 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:47 nativespace-cdp sudo[1348525]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:47 nativespace-cdp sudo[1348528]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 07:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:51 nativespace-cdp sudo[1348532]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:51 nativespace-cdp sudo[1348546]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 07:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:56 nativespace-cdp sudo[1348549]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 07:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:57 nativespace-cdp sudo[1348565]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 07:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:57 nativespace-cdp sudo[1348569]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 07:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:57 nativespace-cdp sudo[1348572]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 07:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:57 nativespace-cdp sudo[1348576]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 07:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:57 nativespace-cdp sudo[1348579]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 07:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:09:57 nativespace-cdp sudo[1348582]: pam_unix(sudo:session): session closed for user root
Sep 13 07:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 07:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:10:00 nativespace-cdp sudo[1348595]: pam_unix(sudo:session): session closed for user root
Sep 13 07:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 07:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:10:09 nativespace-cdp sudo[1348602]: pam_unix(sudo:session): session closed for user root
Sep 13 07:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lbscrmod user-2=maflemin user-3=vantagep user-4=athenare user-5=connect9 user-6=markward user-7=booff user-8=foundation user-9=ulsukarm user-10=hodgesonweb user-11=theblack user-12=spectrum user-13=jarvisin user-14=leereyn1 user-15=stephani user-16=agproduc user-17=still user-18=atestord user-19=sarafoundation user-20=strathar user-21=lakesan1 user-22=brmrjxl user-23=megacards user-24=musorguk user-25=wilsonsw user-26=ptkxhsbt user-27=dickemery123 user-28=martsblo user-29=magichat user-30=hhdugcor user-31=lbhyisi user-32=coursemc user-33=opaiscyx user-34=firstres user-35=ultbcrra user-36=seftvta user-37=jonhartl user-38=highlegh user-39=southlon user-40=firstred user-41=costestimatorco user-42=firstrel user-43=clarkass user-44=fetch user-45=carsinyo user-46=hubmaster user-47=putterfi
Sep 13 07:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=elecleis user-49=gilpin user-50=milloyco user-51=thqkgnbz user-52=connectedshoppin user-53=ianrayne user-54=accooper user-55=oneoarco user-56=battlere user-57=vivienn1 user-58=firstre2 user-59=nstriton user-60=brighto1 user-61=bemadonn user-62=newstoda user-63=ggaaorgu user-64=belle user-65=bedfords user-66=skyfirec user-67=alexadmin user-68=nativene user-69=askhform user-70=stuartge user-71=innovat1 user-72=sibtoncc user-73=asandcoc user-74=steve user-75=zebrapho user-76=bwppodcast user-77=nsceres user-78=fawcettd user-79=burydropin user-80=dhyana user-81=darkstar user-82=eatspam user-83=beauty user-84=firstre5 user-85=donnychicago user-86=steakbridieme user-87=philmcph user-88=ctedorgu user-89=lkpier user-90=foods user-91=leftie user-92=health2045 user-93=fortunaz user-94=nscdp user-95=putterfc user-96=barbersh user-97=tigerlet user-98=nomistakes user-99=hidden user-100=smrszyqg user-101=isleofwi
Sep 13 07:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=cwsocial user-103=pugwash user-104=howardon user-105=paulmca1 user-106=ninejimm user-107=reliable user-108=cambria1 user-109=cathski user-110=courseme user-111=eugincou user-112=hirefootballgame user-113=jennimil user-114=tomandle user-115=david user-116=nbhavers user-117=careers user-118=mcdermos user-119=chrisdal user-120=onlycont user-121=lucy user-122=attlebor user-123=romaldki user-124=branko user-125=hodgsonmail user-126=ranxterc user-127=outdoorc user-128=boldover user-129=nove user-130=crrtipdl user-131=sosevalu user-132=bakery user-133=nvihkvu user-134=havantho user-135=sketchy user-136=cath user-137=what user-138=tstardom user-139=oubpgvbx user-140=design user-141=kategilpin user-142=stagingerris user-143=dancinggardener user-144=ladburyp feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 07:10:09 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 07:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:10:12 nativespace-cdp sudo[1348743]: pam_unix(sudo:session): session closed for user root
Sep 13 07:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 07:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:10:15 nativespace-cdp sudo[1348783]: pam_unix(sudo:session): session closed for user root
Sep 13 07:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vBQq8R2PMGb8Rtz1.~
Sep 13 07:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:10:15 nativespace-cdp sudo[1348788]: pam_unix(sudo:session): session closed for user root
Sep 13 07:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vBQq8R2PMGb8Rtz1.~'
Sep 13 07:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:10:15 nativespace-cdp sudo[1348791]: pam_unix(sudo:session): session closed for user root
Sep 13 07:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-vBQq8R2PMGb8Rtz1.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 07:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:10:15 nativespace-cdp sudo[1348795]: pam_unix(sudo:session): session closed for user root
Sep 13 07:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 07:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:10:15 nativespace-cdp sudo[1348798]: pam_unix(sudo:session): session closed for user root
Sep 13 07:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 07:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 07:10:19 nativespace-cdp sudo[1348861]: pam_unix(sudo:session): session closed for user root
Sep 13 07:11:35 nativespace-cdp sshd[1349280]: Connection closed by 159.100.136.21 port 39520 [preauth]
Sep 13 07:16:34 nativespace-cdp sshd[1350726]: Connection closed by 159.100.136.21 port 48926 [preauth]
Sep 13 07:21:36 nativespace-cdp sshd[1351761]: Connection closed by 159.100.136.21 port 58388 [preauth]
Sep 13 07:26:33 nativespace-cdp sshd[1353034]: Connection closed by 159.100.136.21 port 39720 [preauth]
Sep 13 07:31:33 nativespace-cdp sshd[1354492]: Connection closed by 159.100.136.21 port 49146 [preauth]
Sep 13 07:36:34 nativespace-cdp sshd[1355595]: Connection closed by 159.100.136.21 port 58538 [preauth]
Sep 13 07:38:34 nativespace-cdp sshd[1355928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.14.5.226  user=root
Sep 13 07:38:34 nativespace-cdp sshd[1355928]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:38:37 nativespace-cdp sshd[1355928]: Failed password for root from 190.14.5.226 port 13526 ssh2
Sep 13 07:38:37 nativespace-cdp sshd[1355928]: Received disconnect from 190.14.5.226 port 13526:11: Bye Bye [preauth]
Sep 13 07:38:37 nativespace-cdp sshd[1355928]: Disconnected from 190.14.5.226 port 13526 [preauth]
Sep 13 07:41:33 nativespace-cdp sshd[1356958]: Connection closed by 159.100.136.21 port 38866 [preauth]
Sep 13 07:42:09 nativespace-cdp sshd[1357099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.29.149.124  user=root
Sep 13 07:42:09 nativespace-cdp sshd[1357099]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:42:11 nativespace-cdp sshd[1357099]: Failed password for root from 66.29.149.124 port 44904 ssh2
Sep 13 07:42:15 nativespace-cdp sshd[1357099]: Received disconnect from 66.29.149.124 port 44904:11: Bye Bye [preauth]
Sep 13 07:42:15 nativespace-cdp sshd[1357099]: Disconnected from 66.29.149.124 port 44904 [preauth]
Sep 13 07:46:09 nativespace-cdp sshd[1358233]: Invalid user madan from 179.83.80.38 port 51362
Sep 13 07:46:09 nativespace-cdp sshd[1358233]: input_userauth_request: invalid user madan [preauth]
Sep 13 07:46:09 nativespace-cdp sshd[1358233]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 07:46:09 nativespace-cdp sshd[1358233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.83.80.38
Sep 13 07:46:09 nativespace-cdp sshd[1358246]: Invalid user wekan from 45.228.234.40 port 34934
Sep 13 07:46:09 nativespace-cdp sshd[1358246]: input_userauth_request: invalid user wekan [preauth]
Sep 13 07:46:09 nativespace-cdp sshd[1358246]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 07:46:09 nativespace-cdp sshd[1358246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.228.234.40
Sep 13 07:46:11 nativespace-cdp sshd[1358233]: Failed password for invalid user madan from 179.83.80.38 port 51362 ssh2
Sep 13 07:46:11 nativespace-cdp sshd[1358233]: Received disconnect from 179.83.80.38 port 51362:11: Bye Bye [preauth]
Sep 13 07:46:11 nativespace-cdp sshd[1358233]: Disconnected from 179.83.80.38 port 51362 [preauth]
Sep 13 07:46:11 nativespace-cdp sshd[1358246]: Failed password for invalid user wekan from 45.228.234.40 port 34934 ssh2
Sep 13 07:46:11 nativespace-cdp sshd[1358246]: Received disconnect from 45.228.234.40 port 34934:11: Bye Bye [preauth]
Sep 13 07:46:11 nativespace-cdp sshd[1358246]: Disconnected from 45.228.234.40 port 34934 [preauth]
Sep 13 07:46:34 nativespace-cdp sshd[1358355]: Connection closed by 159.100.136.21 port 48158 [preauth]
Sep 13 07:46:52 nativespace-cdp sshd[1358400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.228.234.40  user=root
Sep 13 07:46:52 nativespace-cdp sshd[1358400]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:46:54 nativespace-cdp sshd[1358400]: Failed password for root from 45.228.234.40 port 41562 ssh2
Sep 13 07:46:54 nativespace-cdp sshd[1358400]: Received disconnect from 45.228.234.40 port 41562:11: Bye Bye [preauth]
Sep 13 07:46:54 nativespace-cdp sshd[1358400]: Disconnected from 45.228.234.40 port 41562 [preauth]
Sep 13 07:47:29 nativespace-cdp sshd[1358477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.7.241.146  user=root
Sep 13 07:47:29 nativespace-cdp sshd[1358477]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:47:31 nativespace-cdp sshd[1358477]: Failed password for root from 61.7.241.146 port 44122 ssh2
Sep 13 07:47:31 nativespace-cdp sshd[1358477]: Received disconnect from 61.7.241.146 port 44122:11: Bye Bye [preauth]
Sep 13 07:47:31 nativespace-cdp sshd[1358477]: Disconnected from 61.7.241.146 port 44122 [preauth]
Sep 13 07:47:36 nativespace-cdp sshd[1358512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.29.149.124  user=root
Sep 13 07:47:36 nativespace-cdp sshd[1358512]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:47:38 nativespace-cdp sshd[1358512]: Failed password for root from 66.29.149.124 port 58718 ssh2
Sep 13 07:47:38 nativespace-cdp sshd[1358512]: Received disconnect from 66.29.149.124 port 58718:11: Bye Bye [preauth]
Sep 13 07:47:38 nativespace-cdp sshd[1358512]: Disconnected from 66.29.149.124 port 58718 [preauth]
Sep 13 07:47:40 nativespace-cdp sshd[1358525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.228.234.40  user=root
Sep 13 07:47:40 nativespace-cdp sshd[1358525]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:47:42 nativespace-cdp sshd[1358525]: Failed password for root from 45.228.234.40 port 63112 ssh2
Sep 13 07:47:44 nativespace-cdp sshd[1358525]: Received disconnect from 45.228.234.40 port 63112:11: Bye Bye [preauth]
Sep 13 07:47:44 nativespace-cdp sshd[1358525]: Disconnected from 45.228.234.40 port 63112 [preauth]
Sep 13 07:47:46 nativespace-cdp sshd[1358549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.83.80.38  user=root
Sep 13 07:47:46 nativespace-cdp sshd[1358549]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:47:48 nativespace-cdp sshd[1358549]: Failed password for root from 179.83.80.38 port 40430 ssh2
Sep 13 07:47:48 nativespace-cdp sshd[1358549]: Received disconnect from 179.83.80.38 port 40430:11: Bye Bye [preauth]
Sep 13 07:47:48 nativespace-cdp sshd[1358549]: Disconnected from 179.83.80.38 port 40430 [preauth]
Sep 13 07:48:16 nativespace-cdp sshd[1358683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.7.241.146  user=root
Sep 13 07:48:16 nativespace-cdp sshd[1358683]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:48:18 nativespace-cdp sshd[1358683]: Failed password for root from 61.7.241.146 port 38430 ssh2
Sep 13 07:48:18 nativespace-cdp sshd[1358683]: Received disconnect from 61.7.241.146 port 38430:11: Bye Bye [preauth]
Sep 13 07:48:18 nativespace-cdp sshd[1358683]: Disconnected from 61.7.241.146 port 38430 [preauth]
Sep 13 07:48:36 nativespace-cdp sshd[1358730]: Invalid user es from 190.14.5.226 port 49130
Sep 13 07:48:36 nativespace-cdp sshd[1358730]: input_userauth_request: invalid user es [preauth]
Sep 13 07:48:36 nativespace-cdp sshd[1358730]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 07:48:36 nativespace-cdp sshd[1358730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.14.5.226
Sep 13 07:48:38 nativespace-cdp sshd[1358730]: Failed password for invalid user es from 190.14.5.226 port 49130 ssh2
Sep 13 07:48:38 nativespace-cdp sshd[1358730]: Received disconnect from 190.14.5.226 port 49130:11: Bye Bye [preauth]
Sep 13 07:48:38 nativespace-cdp sshd[1358730]: Disconnected from 190.14.5.226 port 49130 [preauth]
Sep 13 07:48:48 nativespace-cdp sshd[1358835]: Invalid user lijian from 179.83.80.38 port 53530
Sep 13 07:48:48 nativespace-cdp sshd[1358835]: input_userauth_request: invalid user lijian [preauth]
Sep 13 07:48:48 nativespace-cdp sshd[1358835]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 07:48:48 nativespace-cdp sshd[1358835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.83.80.38
Sep 13 07:48:50 nativespace-cdp sshd[1358835]: Failed password for invalid user lijian from 179.83.80.38 port 53530 ssh2
Sep 13 07:48:50 nativespace-cdp sshd[1358835]: Received disconnect from 179.83.80.38 port 53530:11: Bye Bye [preauth]
Sep 13 07:48:50 nativespace-cdp sshd[1358835]: Disconnected from 179.83.80.38 port 53530 [preauth]
Sep 13 07:49:20 nativespace-cdp sshd[1358921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.7.241.146  user=root
Sep 13 07:49:20 nativespace-cdp sshd[1358921]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:49:22 nativespace-cdp sshd[1358961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.14.5.226  user=root
Sep 13 07:49:22 nativespace-cdp sshd[1358961]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 07:49:22 nativespace-cdp sshd[1358921]: Failed password for root from 61.7.241.146 port 44604 ssh2
Sep 13 07:49:22 nativespace-cdp sshd[1358921]: Received disconnect from 61.7.241.146 port 44604:11: Bye Bye [preauth]
Sep 13 07:49:22 nativespace-cdp sshd[1358921]: Disconnected from 61.7.241.146 port 44604 [preauth]
Sep 13 07:49:24 nativespace-cdp sshd[1358961]: Failed password for root from 190.14.5.226 port 62294 ssh2
Sep 13 07:49:24 nativespace-cdp sshd[1358961]: Received disconnect from 190.14.5.226 port 62294:11: Bye Bye [preauth]
Sep 13 07:49:24 nativespace-cdp sshd[1358961]: Disconnected from 190.14.5.226 port 62294 [preauth]
Sep 13 07:51:33 nativespace-cdp sshd[1359570]: Connection closed by 159.100.136.21 port 55580 [preauth]
Sep 13 07:56:34 nativespace-cdp sshd[1361474]: Connection closed by 159.100.136.21 port 35166 [preauth]
Sep 13 08:01:34 nativespace-cdp sshd[1363619]: Connection closed by 159.100.136.21 port 44748 [preauth]
Sep 13 08:06:33 nativespace-cdp sshd[1365338]: Connection closed by 159.100.136.21 port 54668 [preauth]
Sep 13 08:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 08:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:39 nativespace-cdp sudo[1365910]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 08:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:39 nativespace-cdp sudo[1365917]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 08:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:42 nativespace-cdp sudo[1365920]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 08:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:42 nativespace-cdp sudo[1365934]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 08:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:48 nativespace-cdp sudo[1365938]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 08:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:48 nativespace-cdp sudo[1366036]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 08:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:48 nativespace-cdp sudo[1366039]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 08:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:48 nativespace-cdp sudo[1366043]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 08:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:48 nativespace-cdp sudo[1366046]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 08:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:48 nativespace-cdp sudo[1366052]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 08:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:48 nativespace-cdp sudo[1366056]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 08:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:51 nativespace-cdp sudo[1366064]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 08:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:57 nativespace-cdp sudo[1366070]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=markward user-3=foundation user-4=booff user-5=lbscrmod user-6=maflemin user-7=vantagep user-8=connect9 user-9=athenare user-10=agproduc user-11=still user-12=leereyn1 user-13=stephani user-14=jarvisin user-15=theblack user-16=hodgesonweb user-17=spectrum user-18=wilsonsw user-19=megacards user-20=musorguk user-21=brmrjxl user-22=lakesan1 user-23=atestord user-24=sarafoundation user-25=strathar user-26=hhdugcor user-27=lbhyisi user-28=magichat user-29=martsblo user-30=ptkxhsbt user-31=dickemery123 user-32=costestimatorco user-33=firstrel user-34=clarkass user-35=highlegh user-36=southlon user-37=firstred user-38=firstres user-39=ultbcrra user-40=seftvta user-41=jonhartl user-42=opaiscyx user-43=coursemc user-44=ianrayne user-45=accooper user-46=thqkgnbz user-47=connectedshoppin
Sep 13 08:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=elecleis user-49=gilpin user-50=milloyco user-51=fetch user-52=carsinyo user-53=putterfi user-54=hubmaster user-55=bedfords user-56=bemadonn user-57=newstoda user-58=ggaaorgu user-59=belle user-60=nstriton user-61=brighto1 user-62=oneoarco user-63=battlere user-64=vivienn1 user-65=firstre2 user-66=stuartge user-67=askhform user-68=innovat1 user-69=nativene user-70=skyfirec user-71=alexadmin user-72=zebrapho user-73=bwppodcast user-74=steve user-75=sibtoncc user-76=asandcoc user-77=darkstar user-78=eatspam user-79=beauty user-80=dhyana user-81=fawcettd user-82=burydropin user-83=nsceres user-84=isleofwi user-85=smrszyqg user-86=tigerlet user-87=barbersh user-88=nomistakes user-89=hidden user-90=leftie user-91=foods user-92=fortunaz user-93=health2045 user-94=nscdp user-95=putterfc user-96=donnychicago user-97=firstre5 user-98=steakbridieme user-99=philmcph user-100=ctedorgu user-101=lkpier
Sep 13 08:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=hirefootballgame user-103=courseme user-104=eugincou user-105=ninejimm user-106=reliable user-107=cambria1 user-108=cathski user-109=cwsocial user-110=howardon user-111=pugwash user-112=paulmca1 user-113=mcdermos user-114=chrisdal user-115=david user-116=nbhavers user-117=careers user-118=tomandle user-119=jennimil user-120=branko user-121=outdoorc user-122=hodgsonmail user-123=ranxterc user-124=romaldki user-125=lucy user-126=attlebor user-127=onlycont user-128=crrtipdl user-129=sosevalu user-130=bakery user-131=nove user-132=boldover user-133=kategilpin user-134=stagingerris user-135=dancinggardener user-136=ladburyp user-137=design user-138=what user-139=oubpgvbx user-140=tstardom user-141=nvihkvu user-142=havantho user-143=cath user-144=sketchy feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 08:09:57 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 08:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:58 nativespace-cdp sudo[1366092]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:59 nativespace-cdp sudo[1366098]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AVMvaTdjGveuujJk.~
Sep 13 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:59 nativespace-cdp sudo[1366101]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AVMvaTdjGveuujJk.~'
Sep 13 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:59 nativespace-cdp sudo[1366104]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AVMvaTdjGveuujJk.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:59 nativespace-cdp sudo[1366108]: pam_unix(sudo:session): session closed for user root
Sep 13 08:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 08:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:09:59 nativespace-cdp sudo[1366111]: pam_unix(sudo:session): session closed for user root
Sep 13 08:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 08:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 08:10:37 nativespace-cdp sudo[1366457]: pam_unix(sudo:session): session closed for user root
Sep 13 08:11:33 nativespace-cdp sshd[1366646]: Connection closed by 159.100.136.21 port 36294 [preauth]
Sep 13 08:16:33 nativespace-cdp sshd[1368057]: Connection closed by 159.100.136.21 port 45978 [preauth]
Sep 13 08:21:35 nativespace-cdp sshd[1369674]: Connection closed by 159.100.136.21 port 55418 [preauth]
Sep 13 08:26:37 nativespace-cdp sshd[1371276]: Connection closed by 159.100.136.21 port 36992 [preauth]
Sep 13 08:31:34 nativespace-cdp sshd[1372707]: Connection closed by 159.100.136.21 port 46070 [preauth]
Sep 13 08:36:34 nativespace-cdp sshd[1373999]: Connection closed by 159.100.136.21 port 55266 [preauth]
Sep 13 08:41:33 nativespace-cdp sshd[1375111]: Connection closed by 159.100.136.21 port 36210 [preauth]
Sep 13 08:46:34 nativespace-cdp sshd[1376556]: Connection closed by 159.100.136.21 port 44094 [preauth]
Sep 13 08:51:33 nativespace-cdp sshd[1378002]: Connection closed by 159.100.136.21 port 53256 [preauth]
Sep 13 08:56:34 nativespace-cdp sshd[1379387]: Connection closed by 159.100.136.21 port 34738 [preauth]
Sep 13 09:01:34 nativespace-cdp sshd[1381120]: Connection closed by 159.100.136.21 port 43640 [preauth]
Sep 13 09:06:33 nativespace-cdp sshd[1382488]: Connection closed by 159.100.136.21 port 52974 [preauth]
Sep 13 09:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 09:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:41 nativespace-cdp sudo[1383132]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 09:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:41 nativespace-cdp sudo[1383136]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 09:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:52 nativespace-cdp sudo[1383139]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 09:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:52 nativespace-cdp sudo[1383166]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 09:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:57 nativespace-cdp sudo[1383169]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 09:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:57 nativespace-cdp sudo[1383186]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 09:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:57 nativespace-cdp sudo[1383190]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 09:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:57 nativespace-cdp sudo[1383194]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 09:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:57 nativespace-cdp sudo[1383197]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 09:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:57 nativespace-cdp sudo[1383200]: pam_unix(sudo:session): session closed for user root
Sep 13 09:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 09:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:09:57 nativespace-cdp sudo[1383203]: pam_unix(sudo:session): session closed for user root
Sep 13 09:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 09:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:10:00 nativespace-cdp sudo[1383225]: pam_unix(sudo:session): session closed for user root
Sep 13 09:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 09:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:10:12 nativespace-cdp sudo[1383229]: pam_unix(sudo:session): session closed for user root
Sep 13 09:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=chrisdal user-4=mcdermos user-5=nbhavers user-6=careers user-7=david user-8=attlebor user-9=lucy user-10=onlycont user-11=ranxterc user-12=hodgsonmail user-13=outdoorc user-14=branko user-15=romaldki user-16=nove user-17=boldover user-18=bakery user-19=sosevalu user-20=crrtipdl user-21=tstardom user-22=oubpgvbx user-23=what user-24=sketchy user-25=cath user-26=havantho user-27=nvihkvu user-28=ladburyp user-29=dancinggardener user-30=stagingerris user-31=kategilpin user-32=design user-33=sibtoncc user-34=asandcoc user-35=bwppodcast user-36=zebrapho user-37=steve user-38=burydropin user-39=fawcettd user-40=nsceres user-41=beauty user-42=eatspam user-43=darkstar user-44=dhyana user-45=putterfc user-46=nscdp user-47=fortunaz user-48=health2045 user-49=leftie
Sep 13 09:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=foods user-51=lkpier user-52=philmcph user-53=ctedorgu user-54=steakbridieme user-55=donnychicago user-56=firstre5 user-57=isleofwi user-58=smrszyqg user-59=hidden user-60=nomistakes user-61=barbersh user-62=tigerlet user-63=cambria1 user-64=cathski user-65=reliable user-66=ninejimm user-67=paulmca1 user-68=pugwash user-69=howardon user-70=cwsocial user-71=hirefootballgame user-72=eugincou user-73=courseme user-74=seftvta user-75=jonhartl user-76=ultbcrra user-77=firstres user-78=opaiscyx user-79=coursemc user-80=firstrel user-81=clarkass user-82=costestimatorco user-83=firstred user-84=southlon user-85=highlegh user-86=gilpin user-87=milloyco user-88=elecleis user-89=putterfi user-90=hubmaster user-91=carsinyo user-92=fetch user-93=accooper user-94=ianrayne user-95=connectedshoppin user-96=thqkgnbz user-97=brighto1 user-98=nstriton user-99=firstre2 user-100=vivienn1 user-101=battlere user-102=oneoarco
Sep 13 09:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=ggaaorgu user-105=belle user-106=newstoda user-107=bemadonn user-108=alexadmin user-109=skyfirec user-110=innovat1 user-111=askhform user-112=stuartge user-113=nativene user-114=markward user-115=booff user-116=foundation user-117=athenare user-118=connect9 user-119=vantagep user-120=maflemin user-121=lbscrmod user-122=ulsukarm user-123=jarvisin user-124=spectrum user-125=theblack user-126=hodgesonweb user-127=still user-128=agproduc user-129=stephani user-130=leereyn1 user-131=brmrjxl user-132=lakesan1 user-133=strathar user-134=sarafoundation user-135=atestord user-136=wilsonsw user-137=musorguk user-138=megacards user-139=martsblo user-140=dickemery123 user-141=ptkxhsbt user-142=lbhyisi user-143=hhdugcor user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 09:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 09:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:10:14 nativespace-cdp sudo[1383374]: pam_unix(sudo:session): session closed for user root
Sep 13 09:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 09:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:10:16 nativespace-cdp sudo[1383395]: pam_unix(sudo:session): session closed for user root
Sep 13 09:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FMca3Q7LDtxmOwXs.~
Sep 13 09:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:10:17 nativespace-cdp sudo[1383400]: pam_unix(sudo:session): session closed for user root
Sep 13 09:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FMca3Q7LDtxmOwXs.~'
Sep 13 09:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:10:17 nativespace-cdp sudo[1383403]: pam_unix(sudo:session): session closed for user root
Sep 13 09:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-FMca3Q7LDtxmOwXs.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 09:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:10:17 nativespace-cdp sudo[1383407]: pam_unix(sudo:session): session closed for user root
Sep 13 09:10:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 09:10:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:10:17 nativespace-cdp sudo[1383410]: pam_unix(sudo:session): session closed for user root
Sep 13 09:10:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 09:10:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 09:11:02 nativespace-cdp sudo[1383655]: pam_unix(sudo:session): session closed for user root
Sep 13 09:11:35 nativespace-cdp sshd[1383814]: Connection closed by 159.100.136.21 port 34196 [preauth]
Sep 13 09:16:33 nativespace-cdp sshd[1385471]: Connection closed by 159.100.136.21 port 43916 [preauth]
Sep 13 09:21:36 nativespace-cdp sshd[1386728]: Connection closed by 159.100.136.21 port 53448 [preauth]
Sep 13 09:26:36 nativespace-cdp sshd[1387782]: Connection closed by 159.100.136.21 port 34550 [preauth]
Sep 13 09:31:33 nativespace-cdp sshd[1389205]: Connection closed by 159.100.136.21 port 43708 [preauth]
Sep 13 09:36:34 nativespace-cdp sshd[1390870]: Connection closed by 159.100.136.21 port 53364 [preauth]
Sep 13 09:41:34 nativespace-cdp sshd[1392375]: Connection closed by 159.100.136.21 port 34698 [preauth]
Sep 13 09:46:36 nativespace-cdp sshd[1393773]: Connection closed by 159.100.136.21 port 43538 [preauth]
Sep 13 09:51:37 nativespace-cdp sshd[1395222]: Connection closed by 159.100.136.21 port 52420 [preauth]
Sep 13 09:56:34 nativespace-cdp sshd[1396395]: Connection closed by 159.100.136.21 port 33872 [preauth]
Sep 13 10:01:34 nativespace-cdp sshd[1397873]: Connection closed by 159.100.136.21 port 42940 [preauth]
Sep 13 10:06:34 nativespace-cdp sshd[1399516]: Connection closed by 159.100.136.21 port 52382 [preauth]
Sep 13 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:10:03 nativespace-cdp sudo[1400277]: pam_unix(sudo:session): session closed for user root
Sep 13 10:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 10:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:10:04 nativespace-cdp sudo[1400354]: pam_unix(sudo:session): session closed for user root
Sep 13 10:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 10:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:10:39 nativespace-cdp sudo[1400361]: pam_unix(sudo:session): session closed for user root
Sep 13 10:10:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 10:10:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:10:42 nativespace-cdp sudo[1400533]: pam_unix(sudo:session): session closed for user root
Sep 13 10:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 10:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:13 nativespace-cdp sudo[1400544]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 10:11:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:14 nativespace-cdp sudo[1400875]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 10:11:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:14 nativespace-cdp sudo[1400879]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 10:11:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:14 nativespace-cdp sudo[1400882]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 10:11:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:14 nativespace-cdp sudo[1400885]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 10:11:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:14 nativespace-cdp sudo[1400889]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 10:11:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:15 nativespace-cdp sudo[1400892]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 10:11:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:22 nativespace-cdp sudo[1400961]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 10:11:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:25 nativespace-cdp sudo[1401025]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=leereyn1 user-2=stephani user-3=still user-4=agproduc user-5=hodgesonweb user-6=theblack user-7=spectrum user-8=jarvisin user-9=ulsukarm user-10=maflemin user-11=lbscrmod user-12=athenare user-13=connect9 user-14=vantagep user-15=markward user-16=foundation user-17=booff user-18=magichat user-19=lbhyisi user-20=hhdugcor user-21=ptkxhsbt user-22=dickemery123 user-23=martsblo user-24=musorguk user-25=megacards user-26=wilsonsw user-27=sarafoundation user-28=atestord user-29=strathar user-30=brmrjxl user-31=lakesan1 user-32=thqkgnbz user-33=connectedshoppin user-34=ianrayne user-35=accooper user-36=carsinyo user-37=fetch user-38=putterfi user-39=hubmaster user-40=elecleis user-41=gilpin user-42=milloyco user-43=southlon user-44=highlegh user-45=firstred user-46=costestimatorco user-47=firstrel
Sep 13 10:11:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=clarkass user-49=opaiscyx user-50=coursemc user-51=firstres user-52=seftvta user-53=jonhartl user-54=ultbcrra user-55=nativene user-56=askhform user-57=stuartge user-58=innovat1 user-59=skyfirec user-60=alexadmin user-61=bemadonn user-62=belle user-63=ggaaorgu user-64=newstoda user-65=bedfords user-66=battlere user-67=oneoarco user-68=firstre2 user-69=vivienn1 user-70=brighto1 user-71=nstriton user-72=dhyana user-73=eatspam user-74=darkstar user-75=beauty user-76=nsceres user-77=burydropin user-78=fawcettd user-79=steve user-80=zebrapho user-81=bwppodcast user-82=sibtoncc user-83=asandcoc user-84=courseme user-85=eugincou user-86=hirefootballgame user-87=paulmca1 user-88=pugwash user-89=howardon user-90=cwsocial user-91=reliable user-92=ninejimm user-93=cathski user-94=cambria1 user-95=barbersh user-96=tigerlet user-97=hidden user-98=nomistakes user-99=isleofwi user-100=smrszyqg user-101=philmcph
Sep 13 10:11:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ctedorgu user-103=steakbridieme user-104=firstre5 user-105=donnychicago user-106=lkpier user-107=health2045 user-108=fortunaz user-109=leftie user-110=foods user-111=putterfc user-112=nscdp user-113=romaldki user-114=branko user-115=ranxterc user-116=hodgsonmail user-117=outdoorc user-118=onlycont user-119=attlebor user-120=lucy user-121=careers user-122=nbhavers user-123=david user-124=mcdermos user-125=chrisdal user-126=jennimil user-127=tomandle user-128=design user-129=kategilpin user-130=ladburyp user-131=dancinggardener user-132=stagingerris user-133=nvihkvu user-134=cath user-135=sketchy user-136=havantho user-137=what user-138=oubpgvbx user-139=tstardom user-140=sosevalu user-141=crrtipdl user-142=bakery user-143=boldover user-144=nove feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 10:11:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 10:11:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:27 nativespace-cdp sudo[1401032]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 10:11:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:30 nativespace-cdp sudo[1401111]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nrmOUKEkqsNd9hm3.~
Sep 13 10:11:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:30 nativespace-cdp sudo[1401125]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nrmOUKEkqsNd9hm3.~'
Sep 13 10:11:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:30 nativespace-cdp sudo[1401130]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-nrmOUKEkqsNd9hm3.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 10:11:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:31 nativespace-cdp sudo[1401134]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 10:11:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:31 nativespace-cdp sudo[1401137]: pam_unix(sudo:session): session closed for user root
Sep 13 10:11:34 nativespace-cdp sshd[1401202]: Connection closed by 159.100.136.21 port 32830 [preauth]
Sep 13 10:11:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 10:11:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 10:11:38 nativespace-cdp sudo[1401258]: pam_unix(sudo:session): session closed for user root
Sep 13 10:16:33 nativespace-cdp sshd[1402894]: Connection closed by 159.100.136.21 port 42236 [preauth]
Sep 13 10:21:33 nativespace-cdp sshd[1404180]: Connection closed by 159.100.136.21 port 51630 [preauth]
Sep 13 10:26:33 nativespace-cdp sshd[1405488]: Connection closed by 159.100.136.21 port 60548 [preauth]
Sep 13 10:31:33 nativespace-cdp sshd[1407260]: Connection closed by 159.100.136.21 port 41530 [preauth]
Sep 13 10:36:35 nativespace-cdp sshd[1408660]: Connection closed by 159.100.136.21 port 51538 [preauth]
Sep 13 10:41:37 nativespace-cdp sshd[1410196]: Connection closed by 159.100.136.21 port 60918 [preauth]
Sep 13 10:46:36 nativespace-cdp sshd[1411703]: Connection closed by 159.100.136.21 port 42384 [preauth]
Sep 13 10:51:36 nativespace-cdp sshd[1413032]: Connection closed by 159.100.136.21 port 51880 [preauth]
Sep 13 10:56:34 nativespace-cdp sshd[1414473]: Connection closed by 159.100.136.21 port 32974 [preauth]
Sep 13 11:01:34 nativespace-cdp sshd[1416115]: Connection closed by 159.100.136.21 port 42606 [preauth]
Sep 13 11:02:08 nativespace-cdp sshd[1416233]: Connection closed by 167.94.146.49 port 48522 [preauth]
Sep 13 11:06:37 nativespace-cdp sshd[1417447]: Connection closed by 159.100.136.21 port 52482 [preauth]
Sep 13 11:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 11:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:01 nativespace-cdp sudo[1418120]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 11:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:01 nativespace-cdp sudo[1418125]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 11:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:25 nativespace-cdp sudo[1418169]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 11:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:25 nativespace-cdp sudo[1418422]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 11:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:35 nativespace-cdp sudo[1418429]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 11:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:35 nativespace-cdp sudo[1418520]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 11:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:35 nativespace-cdp sudo[1418524]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 11:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:35 nativespace-cdp sudo[1418527]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 11:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:35 nativespace-cdp sudo[1418530]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 11:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:35 nativespace-cdp sudo[1418533]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 11:10:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:36 nativespace-cdp sudo[1418538]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 11:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:38 nativespace-cdp sudo[1418546]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 11:10:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:45 nativespace-cdp sudo[1418551]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=ptkxhsbt user-3=dickemery123 user-4=lbhyisi user-5=hhdugcor user-6=magichat user-7=lakesan1 user-8=brmrjxl user-9=sarafoundation user-10=atestord user-11=strathar user-12=wilsonsw user-13=musorguk user-14=megacards user-15=jarvisin user-16=theblack user-17=hodgesonweb user-18=spectrum user-19=still user-20=agproduc user-21=leereyn1 user-22=stephani user-23=foundation user-24=markward user-25=booff user-26=maflemin user-27=lbscrmod user-28=athenare user-29=connect9 user-30=vantagep user-31=ulsukarm user-32=alexadmin user-33=skyfirec user-34=stuartge user-35=askhform user-36=innovat1 user-37=nativene user-38=brighto1 user-39=nstriton user-40=battlere user-41=oneoarco user-42=firstre2 user-43=vivienn1 user-44=bedfords user-45=bemadonn user-46=belle user-47=ggaaorgu user-48=newstoda
Sep 13 11:10:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=elecleis user-50=gilpin user-51=milloyco user-52=carsinyo user-53=fetch user-54=putterfi user-55=hubmaster user-56=ianrayne user-57=accooper user-58=thqkgnbz user-59=connectedshoppin user-60=firstres user-61=seftvta user-62=jonhartl user-63=ultbcrra user-64=opaiscyx user-65=coursemc user-66=costestimatorco user-67=clarkass user-68=firstrel user-69=southlon user-70=highlegh user-71=firstred user-72=reliable user-73=ninejimm user-74=cambria1 user-75=cathski user-76=paulmca1 user-77=pugwash user-78=howardon user-79=cwsocial user-80=hirefootballgame user-81=courseme user-82=eugincou user-83=fortunaz user-84=health2045 user-85=leftie user-86=foods user-87=putterfc user-88=nscdp user-89=philmcph user-90=ctedorgu user-91=firstre5 user-92=donnychicago user-93=steakbridieme user-94=lkpier user-95=isleofwi user-96=smrszyqg user-97=tigerlet user-98=barbersh user-99=hidden user-100=nomistakes user-101=burydropin
Sep 13 11:10:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=fawcettd user-103=nsceres user-104=eatspam user-105=darkstar user-106=beauty user-107=dhyana user-108=sibtoncc user-109=asandcoc user-110=zebrapho user-111=bwppodcast user-112=steve user-113=what user-114=tstardom user-115=oubpgvbx user-116=nvihkvu user-117=sketchy user-118=cath user-119=havantho user-120=kategilpin user-121=ladburyp user-122=dancinggardener user-123=stagingerris user-124=design user-125=nove user-126=boldover user-127=sosevalu user-128=crrtipdl user-129=bakery user-130=attlebor user-131=lucy user-132=onlycont user-133=branko user-134=hodgsonmail user-135=ranxterc user-136=outdoorc user-137=romaldki user-138=tomandle user-139=jennimil user-140=mcdermos user-141=chrisdal user-142=careers user-143=nbhavers user-144=david feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 11:10:45 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 11:10:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:46 nativespace-cdp sudo[1418572]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 13 11:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:48 nativespace-cdp sudo[1418587]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep 13 11:10:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 13 11:10:48 nativespace-cdp sudo[1418591]: pam_unix(sudo:session): session closed for user onlycont
Sep 13 11:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 13 11:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:49 nativespace-cdp sudo[1418605]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 13 11:10:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 11:10:49 nativespace-cdp sudo[1418609]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 11:10:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 13 11:10:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:52 nativespace-cdp sudo[1418632]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep 13 11:10:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 13 11:10:52 nativespace-cdp sudo[1418637]: pam_unix(sudo:session): session closed for user lkpier
Sep 13 11:10:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 13 11:10:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:53 nativespace-cdp sudo[1418648]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep 13 11:10:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 13 11:10:53 nativespace-cdp sudo[1418653]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 13 11:10:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 13 11:10:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 13 11:10:54 nativespace-cdp sudo[1418667]: pam_unix(sudo:session): session closed for user oneoarco
Sep 13 11:10:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 13 11:10:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:55 nativespace-cdp sudo[1418678]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep 13 11:10:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 13 11:10:57 nativespace-cdp sudo[1418684]: pam_unix(sudo:session): session closed for user fortunaz
Sep 13 11:10:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep 13 11:10:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:58 nativespace-cdp sudo[1418702]: pam_unix(sudo:session): session closed for user root
Sep 13 11:10:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 11:10:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:10:58 nativespace-cdp sudo[1418705]: pam_unix(sudo:session): session closed for user root
Sep 13 11:11:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep 13 11:11:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:11:24 nativespace-cdp sudo[1419817]: pam_unix(sudo:session): session closed for user root
Sep 13 11:11:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep 13 11:11:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:11:24 nativespace-cdp sudo[1419829]: pam_unix(sudo:session): session closed for user root
Sep 13 11:11:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 11:11:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:11:29 nativespace-cdp sudo[1419887]: pam_unix(sudo:session): session closed for user root
Sep 13 11:11:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aZea4HXBdZIvbwag.~
Sep 13 11:11:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:11:29 nativespace-cdp sudo[1419891]: pam_unix(sudo:session): session closed for user root
Sep 13 11:11:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aZea4HXBdZIvbwag.~'
Sep 13 11:11:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:11:29 nativespace-cdp sudo[1419894]: pam_unix(sudo:session): session closed for user root
Sep 13 11:11:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-aZea4HXBdZIvbwag.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 11:11:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:11:29 nativespace-cdp sudo[1419898]: pam_unix(sudo:session): session closed for user root
Sep 13 11:11:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 11:11:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:11:29 nativespace-cdp sudo[1419901]: pam_unix(sudo:session): session closed for user root
Sep 13 11:11:33 nativespace-cdp sshd[1419911]: Connection closed by 159.100.136.21 port 32874 [preauth]
Sep 13 11:11:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 11:11:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 11:11:45 nativespace-cdp sudo[1420046]: pam_unix(sudo:session): session closed for user root
Sep 13 11:16:40 nativespace-cdp sshd[1421662]: Connection closed by 159.100.136.21 port 42338 [preauth]
Sep 13 11:21:36 nativespace-cdp sshd[1422868]: Connection closed by 159.100.136.21 port 51278 [preauth]
Sep 13 11:26:35 nativespace-cdp sshd[1424043]: Connection closed by 159.100.136.21 port 60684 [preauth]
Sep 13 11:31:33 nativespace-cdp sshd[1425534]: Connection closed by 159.100.136.21 port 41922 [preauth]
Sep 13 11:36:35 nativespace-cdp sshd[1427354]: Connection closed by 159.100.136.21 port 51642 [preauth]
Sep 13 11:41:33 nativespace-cdp sshd[1428717]: Connection closed by 159.100.136.21 port 32904 [preauth]
Sep 13 11:44:51 nativespace-cdp sshd[1429798]: Invalid user ali from 47.243.203.180 port 36956
Sep 13 11:44:51 nativespace-cdp sshd[1429798]: input_userauth_request: invalid user ali [preauth]
Sep 13 11:44:51 nativespace-cdp sshd[1429798]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 11:44:51 nativespace-cdp sshd[1429798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.243.203.180
Sep 13 11:44:53 nativespace-cdp sshd[1429798]: Failed password for invalid user ali from 47.243.203.180 port 36956 ssh2
Sep 13 11:44:53 nativespace-cdp sshd[1429798]: Received disconnect from 47.243.203.180 port 36956:11: Bye Bye [preauth]
Sep 13 11:44:53 nativespace-cdp sshd[1429798]: Disconnected from 47.243.203.180 port 36956 [preauth]
Sep 13 11:45:04 nativespace-cdp sshd[1429859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.27.107  user=root
Sep 13 11:45:04 nativespace-cdp sshd[1429859]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 11:45:05 nativespace-cdp sshd[1429859]: Failed password for root from 51.79.27.107 port 45276 ssh2
Sep 13 11:45:05 nativespace-cdp sshd[1429859]: Received disconnect from 51.79.27.107 port 45276:11: Bye Bye [preauth]
Sep 13 11:45:05 nativespace-cdp sshd[1429859]: Disconnected from 51.79.27.107 port 45276 [preauth]
Sep 13 11:46:34 nativespace-cdp sshd[1430704]: Connection closed by 159.100.136.21 port 42430 [preauth]
Sep 13 11:46:35 nativespace-cdp sshd[1430698]: Invalid user ftpuser from 36.93.179.14 port 55952
Sep 13 11:46:35 nativespace-cdp sshd[1430698]: input_userauth_request: invalid user ftpuser [preauth]
Sep 13 11:46:35 nativespace-cdp sshd[1430698]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 11:46:35 nativespace-cdp sshd[1430698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.179.14
Sep 13 11:46:36 nativespace-cdp sshd[1430698]: Failed password for invalid user ftpuser from 36.93.179.14 port 55952 ssh2
Sep 13 11:46:37 nativespace-cdp sshd[1430698]: Received disconnect from 36.93.179.14 port 55952:11: Bye Bye [preauth]
Sep 13 11:46:37 nativespace-cdp sshd[1430698]: Disconnected from 36.93.179.14 port 55952 [preauth]
Sep 13 11:51:34 nativespace-cdp sshd[1431955]: Connection closed by 159.100.136.21 port 51690 [preauth]
Sep 13 11:53:25 nativespace-cdp sshd[1432309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.27.107  user=root
Sep 13 11:53:25 nativespace-cdp sshd[1432309]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 11:53:27 nativespace-cdp sshd[1432309]: Failed password for root from 51.79.27.107 port 40152 ssh2
Sep 13 11:53:37 nativespace-cdp sshd[1432309]: Received disconnect from 51.79.27.107 port 40152:11: Bye Bye [preauth]
Sep 13 11:53:37 nativespace-cdp sshd[1432309]: Disconnected from 51.79.27.107 port 40152 [preauth]
Sep 13 11:54:08 nativespace-cdp sshd[1432433]: Invalid user ubuntu from 51.79.27.107 port 49866
Sep 13 11:54:08 nativespace-cdp sshd[1432433]: input_userauth_request: invalid user ubuntu [preauth]
Sep 13 11:54:08 nativespace-cdp sshd[1432433]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 11:54:08 nativespace-cdp sshd[1432433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.27.107
Sep 13 11:54:10 nativespace-cdp sshd[1432433]: Failed password for invalid user ubuntu from 51.79.27.107 port 49866 ssh2
Sep 13 11:54:10 nativespace-cdp sshd[1432433]: Received disconnect from 51.79.27.107 port 49866:11: Bye Bye [preauth]
Sep 13 11:54:10 nativespace-cdp sshd[1432433]: Disconnected from 51.79.27.107 port 49866 [preauth]
Sep 13 11:54:12 nativespace-cdp sshd[1432450]: Invalid user admin from 36.93.179.14 port 32986
Sep 13 11:54:12 nativespace-cdp sshd[1432450]: input_userauth_request: invalid user admin [preauth]
Sep 13 11:54:12 nativespace-cdp sshd[1432450]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 11:54:12 nativespace-cdp sshd[1432450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.179.14
Sep 13 11:54:14 nativespace-cdp sshd[1432450]: Failed password for invalid user admin from 36.93.179.14 port 32986 ssh2
Sep 13 11:54:14 nativespace-cdp sshd[1432450]: Received disconnect from 36.93.179.14 port 32986:11: Bye Bye [preauth]
Sep 13 11:54:14 nativespace-cdp sshd[1432450]: Disconnected from 36.93.179.14 port 32986 [preauth]
Sep 13 11:54:58 nativespace-cdp sshd[1432637]: Invalid user test10 from 36.93.179.14 port 58944
Sep 13 11:54:58 nativespace-cdp sshd[1432637]: input_userauth_request: invalid user test10 [preauth]
Sep 13 11:54:58 nativespace-cdp sshd[1432637]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 11:54:58 nativespace-cdp sshd[1432637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.179.14
Sep 13 11:55:00 nativespace-cdp sshd[1432637]: Failed password for invalid user test10 from 36.93.179.14 port 58944 ssh2
Sep 13 11:55:00 nativespace-cdp sshd[1432637]: Received disconnect from 36.93.179.14 port 58944:11: Bye Bye [preauth]
Sep 13 11:55:00 nativespace-cdp sshd[1432637]: Disconnected from 36.93.179.14 port 58944 [preauth]
Sep 13 11:56:33 nativespace-cdp sshd[1433282]: Connection closed by 159.100.136.21 port 33082 [preauth]
Sep 13 12:01:35 nativespace-cdp sshd[1434786]: Connection closed by 159.100.136.21 port 42552 [preauth]
Sep 13 12:06:33 nativespace-cdp sshd[1436363]: Connection closed by 159.100.136.21 port 51386 [preauth]
Sep 13 12:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 12:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:48 nativespace-cdp sudo[1437215]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 12:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:48 nativespace-cdp sudo[1437219]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 12:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:52 nativespace-cdp sudo[1437222]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 12:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:52 nativespace-cdp sudo[1437238]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 12:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:57 nativespace-cdp sudo[1437241]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 12:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:57 nativespace-cdp sudo[1437258]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 12:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:58 nativespace-cdp sudo[1437261]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 12:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:58 nativespace-cdp sudo[1437264]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 12:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:58 nativespace-cdp sudo[1437267]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 12:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:58 nativespace-cdp sudo[1437270]: pam_unix(sudo:session): session closed for user root
Sep 13 12:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 12:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:09:58 nativespace-cdp sudo[1437273]: pam_unix(sudo:session): session closed for user root
Sep 13 12:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 12:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:10:08 nativespace-cdp sudo[1437461]: pam_unix(sudo:session): session closed for user root
Sep 13 12:10:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 12:10:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:10:11 nativespace-cdp sudo[1437473]: pam_unix(sudo:session): session closed for user root
Sep 13 12:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=gilpin user-2=milloyco user-3=elecleis user-4=hubmaster user-5=putterfi user-6=fetch user-7=carsinyo user-8=accooper user-9=ianrayne user-10=connectedshoppin user-11=thqkgnbz user-12=ultbcrra user-13=jonhartl user-14=seftvta user-15=firstres user-16=coursemc user-17=opaiscyx user-18=clarkass user-19=firstrel user-20=costestimatorco user-21=firstred user-22=highlegh user-23=southlon user-24=alexadmin user-25=skyfirec user-26=innovat1 user-27=askhform user-28=stuartge user-29=nativene user-30=nstriton user-31=brighto1 user-32=vivienn1 user-33=firstre2 user-34=oneoarco user-35=battlere user-36=bedfords user-37=newstoda user-38=ggaaorgu user-39=belle user-40=bemadonn user-41=jarvisin user-42=spectrum user-43=hodgesonweb user-44=theblack user-45=agproduc user-46=still user-47=stephani
Sep 13 12:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=leereyn1 user-49=markward user-50=booff user-51=foundation user-52=vantagep user-53=connect9 user-54=athenare user-55=lbscrmod user-56=maflemin user-57=ulsukarm user-58=martsblo user-59=dickemery123 user-60=ptkxhsbt user-61=hhdugcor user-62=lbhyisi user-63=magichat user-64=lakesan1 user-65=brmrjxl user-66=strathar user-67=atestord user-68=sarafoundation user-69=wilsonsw user-70=megacards user-71=musorguk user-72=lucy user-73=attlebor user-74=onlycont user-75=outdoorc user-76=ranxterc user-77=hodgsonmail user-78=branko user-79=romaldki user-80=tomandle user-81=jennimil user-82=chrisdal user-83=mcdermos user-84=david user-85=careers user-86=nbhavers user-87=tstardom user-88=oubpgvbx user-89=what user-90=havantho user-91=sketchy user-92=cath user-93=nvihkvu user-94=dancinggardener user-95=stagingerris user-96=ladburyp user-97=kategilpin user-98=design user-99=nove user-100=boldover user-101=bakery
Sep 13 12:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=crrtipdl user-103=sosevalu user-104=fawcettd user-105=burydropin user-106=nsceres user-107=beauty user-108=darkstar user-109=eatspam user-110=dhyana user-111=sibtoncc user-112=asandcoc user-113=bwppodcast user-114=zebrapho user-115=steve user-116=cathski user-117=cambria1 user-118=reliable user-119=ninejimm user-120=cwsocial user-121=pugwash user-122=paulmca1 user-123=howardon user-124=hirefootballgame user-125=eugincou user-126=courseme user-127=nscdp user-128=putterfc user-129=leftie user-130=foods user-131=fortunaz user-132=health2045 user-133=lkpier user-134=steakbridieme user-135=donnychicago user-136=firstre5 user-137=philmcph user-138=ctedorgu user-139=isleofwi user-140=smrszyqg user-141=nomistakes user-142=hidden user-143=barbersh user-144=tigerlet feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 13 12:10:12 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 12:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:10:15 nativespace-cdp sudo[1437484]: pam_unix(sudo:session): session closed for user root
Sep 13 12:10:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 12:10:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:10:15 nativespace-cdp sudo[1437499]: pam_unix(sudo:session): session closed for user root
Sep 13 12:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-h7KXqtiFBZei9lbD.~
Sep 13 12:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:10:16 nativespace-cdp sudo[1437502]: pam_unix(sudo:session): session closed for user root
Sep 13 12:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-h7KXqtiFBZei9lbD.~'
Sep 13 12:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:10:16 nativespace-cdp sudo[1437506]: pam_unix(sudo:session): session closed for user root
Sep 13 12:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-h7KXqtiFBZei9lbD.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 12:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:10:16 nativespace-cdp sudo[1437510]: pam_unix(sudo:session): session closed for user root
Sep 13 12:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 12:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:10:16 nativespace-cdp sudo[1437513]: pam_unix(sudo:session): session closed for user root
Sep 13 12:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 12:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 12:10:38 nativespace-cdp sudo[1437646]: pam_unix(sudo:session): session closed for user root
Sep 13 12:11:34 nativespace-cdp sshd[1438027]: Connection closed by 159.100.136.21 port 60734 [preauth]
Sep 13 12:16:35 nativespace-cdp sshd[1439900]: Connection closed by 159.100.136.21 port 42212 [preauth]
Sep 13 12:21:34 nativespace-cdp sshd[1441123]: Connection closed by 159.100.136.21 port 51408 [preauth]
Sep 13 12:26:34 nativespace-cdp sshd[1442235]: Connection closed by 159.100.136.21 port 32776 [preauth]
Sep 13 12:31:34 nativespace-cdp sshd[1443469]: Connection closed by 159.100.136.21 port 41624 [preauth]
Sep 13 12:36:34 nativespace-cdp sshd[1444811]: Connection closed by 159.100.136.21 port 50692 [preauth]
Sep 13 12:41:33 nativespace-cdp sshd[1446160]: Connection closed by 159.100.136.21 port 60090 [preauth]
Sep 13 12:46:34 nativespace-cdp sshd[1447663]: Connection closed by 159.100.136.21 port 40776 [preauth]
Sep 13 12:51:34 nativespace-cdp sshd[1449254]: Connection closed by 159.100.136.21 port 49888 [preauth]
Sep 13 12:56:35 nativespace-cdp sshd[1450189]: Connection closed by 159.100.136.21 port 59034 [preauth]
Sep 13 12:57:15 nativespace-cdp sshd[1450646]: Bad protocol version identification '\003' from 91.238.181.34 port 65212
Sep 13 13:01:33 nativespace-cdp sshd[1452234]: Connection closed by 159.100.136.21 port 39588 [preauth]
Sep 13 13:06:38 nativespace-cdp sshd[1453505]: Did not receive identification string from 159.100.136.21 port 47470
Sep 13 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:09:53 nativespace-cdp sudo[1455891]: pam_unix(sudo:session): session closed for user root
Sep 13 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:09:53 nativespace-cdp sudo[1455895]: pam_unix(sudo:session): session closed for user root
Sep 13 13:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 13:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:35 nativespace-cdp sudo[1455898]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 13:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:35 nativespace-cdp sudo[1456195]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 13:10:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:42 nativespace-cdp sudo[1456198]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 13:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:42 nativespace-cdp sudo[1456229]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 13:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:42 nativespace-cdp sudo[1456232]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 13:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:42 nativespace-cdp sudo[1456235]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 13:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:42 nativespace-cdp sudo[1456238]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 13:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:42 nativespace-cdp sudo[1456241]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 13:10:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:42 nativespace-cdp sudo[1456244]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 13:10:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:52 nativespace-cdp sudo[1456316]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 13:10:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:10:59 nativespace-cdp sudo[1456323]: pam_unix(sudo:session): session closed for user root
Sep 13 13:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=alexadmin user-2=skyfirec user-3=nativene user-4=stuartge user-5=askhform user-6=innovat1 user-7=battlere user-8=oneoarco user-9=firstre2 user-10=vivienn1 user-11=brighto1 user-12=nstriton user-13=bemadonn user-14=ggaaorgu user-15=belle user-16=newstoda user-17=bedfords user-18=carsinyo user-19=fetch user-20=putterfi user-21=hubmaster user-22=elecleis user-23=milloyco user-24=gilpin user-25=thqkgnbz user-26=connectedshoppin user-27=ianrayne user-28=accooper user-29=opaiscyx user-30=coursemc user-31=firstres user-32=seftvta user-33=jonhartl user-34=ultbcrra user-35=southlon user-36=highlegh user-37=firstred user-38=costestimatorco user-39=firstrel user-40=clarkass user-41=ptkxhsbt user-42=dickemery123 user-43=martsblo user-44=magichat user-45=lbhyisi user-46=hhdugcor user-47=sarafoundation
Sep 13 13:10:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=atestord user-49=strathar user-50=lakesan1 user-51=brmrjxl user-52=musorguk user-53=megacards user-54=wilsonsw user-55=hodgesonweb user-56=theblack user-57=spectrum user-58=jarvisin user-59=leereyn1 user-60=stephani user-61=still user-62=agproduc user-63=maflemin user-64=lbscrmod user-65=athenare user-66=connect9 user-67=vantagep user-68=markward user-69=booff user-70=foundation user-71=ulsukarm user-72=nvihkvu user-73=sketchy user-74=cath user-75=havantho user-76=what user-77=tstardom user-78=oubpgvbx user-79=design user-80=kategilpin user-81=ladburyp user-82=stagingerris user-83=dancinggardener user-84=boldover user-85=nove user-86=sosevalu user-87=crrtipdl user-88=bakery user-89=onlycont user-90=attlebor user-91=lucy user-92=romaldki user-93=branko user-94=ranxterc user-95=hodgsonmail user-96=outdoorc user-97=jennimil user-98=tomandle user-99=nbhavers user-100=careers user-101=david user-102=mcdermos
Sep 13 13:10:59 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=chrisdal user-104=paulmca1 user-105=pugwash user-106=howardon user-107=cwsocial user-108=ninejimm user-109=reliable user-110=cathski user-111=cambria1 user-112=courseme user-113=eugincou user-114=hirefootballgame user-115=philmcph user-116=ctedorgu user-117=donnychicago user-118=firstre5 user-119=steakbridieme user-120=lkpier user-121=fortunaz user-122=health2045 user-123=foods user-124=leftie user-125=putterfc user-126=nscdp user-127=barbersh user-128=tigerlet user-129=hidden user-130=nomistakes user-131=smrszyqg user-132=isleofwi user-133=nsceres user-134=burydropin user-135=fawcettd user-136=dhyana user-137=eatspam user-138=darkstar user-139=beauty user-140=sibtoncc user-141=asandcoc user-142=steve user-143=zebrapho user-144=bwppodcast feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 13:10:59 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 13:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:11:01 nativespace-cdp sudo[1456363]: pam_unix(sudo:session): session closed for user root
Sep 13 13:11:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 13:11:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:11:02 nativespace-cdp sudo[1456407]: pam_unix(sudo:session): session closed for user root
Sep 13 13:11:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-CL6F5mggG4LNOFrI.~
Sep 13 13:11:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:11:03 nativespace-cdp sudo[1456421]: pam_unix(sudo:session): session closed for user root
Sep 13 13:11:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-CL6F5mggG4LNOFrI.~'
Sep 13 13:11:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:11:03 nativespace-cdp sudo[1456424]: pam_unix(sudo:session): session closed for user root
Sep 13 13:11:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-CL6F5mggG4LNOFrI.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 13:11:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:11:03 nativespace-cdp sudo[1456428]: pam_unix(sudo:session): session closed for user root
Sep 13 13:11:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 13:11:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:11:03 nativespace-cdp sudo[1456431]: pam_unix(sudo:session): session closed for user root
Sep 13 13:11:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 13:11:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 13:11:09 nativespace-cdp sudo[1456523]: pam_unix(sudo:session): session closed for user root
Sep 13 13:11:33 nativespace-cdp sshd[1456699]: Connection closed by 159.100.136.21 port 56208 [preauth]
Sep 13 13:14:36 nativespace-cdp sshd[1458060]: Invalid user mtcl from 74.225.198.160 port 1024
Sep 13 13:14:36 nativespace-cdp sshd[1458060]: input_userauth_request: invalid user mtcl [preauth]
Sep 13 13:14:36 nativespace-cdp sshd[1458060]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 13:14:36 nativespace-cdp sshd[1458060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.225.198.160
Sep 13 13:14:38 nativespace-cdp sshd[1458060]: Failed password for invalid user mtcl from 74.225.198.160 port 1024 ssh2
Sep 13 13:14:40 nativespace-cdp sshd[1458060]: Received disconnect from 74.225.198.160 port 1024:11: Bye Bye [preauth]
Sep 13 13:14:40 nativespace-cdp sshd[1458060]: Disconnected from 74.225.198.160 port 1024 [preauth]
Sep 13 13:14:54 nativespace-cdp sshd[1458173]: Invalid user ron from 185.174.136.146 port 39902
Sep 13 13:14:54 nativespace-cdp sshd[1458173]: input_userauth_request: invalid user ron [preauth]
Sep 13 13:14:54 nativespace-cdp sshd[1458173]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 13:14:54 nativespace-cdp sshd[1458173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.174.136.146
Sep 13 13:14:56 nativespace-cdp sshd[1458173]: Failed password for invalid user ron from 185.174.136.146 port 39902 ssh2
Sep 13 13:15:05 nativespace-cdp sshd[1458173]: Received disconnect from 185.174.136.146 port 39902:11: Bye Bye [preauth]
Sep 13 13:15:05 nativespace-cdp sshd[1458173]: Disconnected from 185.174.136.146 port 39902 [preauth]
Sep 13 13:16:34 nativespace-cdp sshd[1459176]: Connection closed by 159.100.136.21 port 35758 [preauth]
Sep 13 13:16:56 nativespace-cdp sshd[1459267]: Invalid user myuser from 190.117.77.15 port 38110
Sep 13 13:16:56 nativespace-cdp sshd[1459267]: input_userauth_request: invalid user myuser [preauth]
Sep 13 13:16:56 nativespace-cdp sshd[1459267]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 13:16:56 nativespace-cdp sshd[1459267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.117.77.15
Sep 13 13:16:58 nativespace-cdp sshd[1459267]: Failed password for invalid user myuser from 190.117.77.15 port 38110 ssh2
Sep 13 13:16:59 nativespace-cdp sshd[1459267]: Received disconnect from 190.117.77.15 port 38110:11: Bye Bye [preauth]
Sep 13 13:16:59 nativespace-cdp sshd[1459267]: Disconnected from 190.117.77.15 port 38110 [preauth]
Sep 13 13:19:10 nativespace-cdp sshd[1460214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.174.136.146  user=root
Sep 13 13:19:10 nativespace-cdp sshd[1460214]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 13:19:11 nativespace-cdp sshd[1460220]: Invalid user test from 74.225.198.160 port 1024
Sep 13 13:19:11 nativespace-cdp sshd[1460220]: input_userauth_request: invalid user test [preauth]
Sep 13 13:19:11 nativespace-cdp sshd[1460220]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 13:19:11 nativespace-cdp sshd[1460220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.225.198.160
Sep 13 13:19:12 nativespace-cdp sshd[1460214]: Failed password for root from 185.174.136.146 port 36184 ssh2
Sep 13 13:19:12 nativespace-cdp sshd[1460214]: Received disconnect from 185.174.136.146 port 36184:11: Bye Bye [preauth]
Sep 13 13:19:12 nativespace-cdp sshd[1460214]: Disconnected from 185.174.136.146 port 36184 [preauth]
Sep 13 13:19:13 nativespace-cdp sshd[1460220]: Failed password for invalid user test from 74.225.198.160 port 1024 ssh2
Sep 13 13:19:13 nativespace-cdp sshd[1460220]: Received disconnect from 74.225.198.160 port 1024:11: Bye Bye [preauth]
Sep 13 13:19:13 nativespace-cdp sshd[1460220]: Disconnected from 74.225.198.160 port 1024 [preauth]
Sep 13 13:19:26 nativespace-cdp sshd[1460401]: Invalid user xzy from 190.117.77.15 port 57280
Sep 13 13:19:26 nativespace-cdp sshd[1460401]: input_userauth_request: invalid user xzy [preauth]
Sep 13 13:19:26 nativespace-cdp sshd[1460401]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 13:19:26 nativespace-cdp sshd[1460401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.117.77.15
Sep 13 13:19:29 nativespace-cdp sshd[1460401]: Failed password for invalid user xzy from 190.117.77.15 port 57280 ssh2
Sep 13 13:19:33 nativespace-cdp sshd[1460401]: Received disconnect from 190.117.77.15 port 57280:11: Bye Bye [preauth]
Sep 13 13:19:33 nativespace-cdp sshd[1460401]: Disconnected from 190.117.77.15 port 57280 [preauth]
Sep 13 13:19:55 nativespace-cdp sshd[1460536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.174.136.146  user=root
Sep 13 13:19:55 nativespace-cdp sshd[1460536]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 13:19:57 nativespace-cdp sshd[1460546]: Invalid user bkd from 74.225.198.160 port 1024
Sep 13 13:19:57 nativespace-cdp sshd[1460546]: input_userauth_request: invalid user bkd [preauth]
Sep 13 13:19:57 nativespace-cdp sshd[1460546]: pam_unix(sshd:auth): check pass; user unknown
Sep 13 13:19:57 nativespace-cdp sshd[1460546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.225.198.160
Sep 13 13:19:58 nativespace-cdp sshd[1460536]: Failed password for root from 185.174.136.146 port 43390 ssh2
Sep 13 13:19:58 nativespace-cdp sshd[1460536]: Received disconnect from 185.174.136.146 port 43390:11: Bye Bye [preauth]
Sep 13 13:19:58 nativespace-cdp sshd[1460536]: Disconnected from 185.174.136.146 port 43390 [preauth]
Sep 13 13:19:59 nativespace-cdp sshd[1460546]: Failed password for invalid user bkd from 74.225.198.160 port 1024 ssh2
Sep 13 13:19:59 nativespace-cdp sshd[1460546]: Received disconnect from 74.225.198.160 port 1024:11: Bye Bye [preauth]
Sep 13 13:19:59 nativespace-cdp sshd[1460546]: Disconnected from 74.225.198.160 port 1024 [preauth]
Sep 13 13:20:20 nativespace-cdp sshd[1460850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.117.77.15  user=root
Sep 13 13:20:20 nativespace-cdp sshd[1460850]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 13:20:23 nativespace-cdp sshd[1460850]: Failed password for root from 190.117.77.15 port 51176 ssh2
Sep 13 13:20:23 nativespace-cdp sshd[1460850]: Received disconnect from 190.117.77.15 port 51176:11: Bye Bye [preauth]
Sep 13 13:20:23 nativespace-cdp sshd[1460850]: Disconnected from 190.117.77.15 port 51176 [preauth]
Sep 13 13:21:33 nativespace-cdp sshd[1461327]: Connection closed by 159.100.136.21 port 45112 [preauth]
Sep 13 13:26:34 nativespace-cdp sshd[1463692]: Connection closed by 159.100.136.21 port 53964 [preauth]
Sep 13 13:31:33 nativespace-cdp sshd[1466310]: Connection closed by 159.100.136.21 port 34734 [preauth]
Sep 13 13:36:34 nativespace-cdp sshd[1468910]: Connection closed by 159.100.136.21 port 44344 [preauth]
Sep 13 13:41:34 nativespace-cdp sshd[1471691]: Connection closed by 159.100.136.21 port 53736 [preauth]
Sep 13 13:46:33 nativespace-cdp sshd[1473344]: Connection closed by 159.100.136.21 port 35156 [preauth]
Sep 13 13:51:34 nativespace-cdp sshd[1474512]: Connection closed by 159.100.136.21 port 44852 [preauth]
Sep 13 13:56:37 nativespace-cdp sshd[1475667]: Connection closed by 159.100.136.21 port 54168 [preauth]
Sep 13 14:01:36 nativespace-cdp sshd[1477090]: Connection closed by 159.100.136.21 port 35212 [preauth]
Sep 13 14:06:38 nativespace-cdp sshd[1478604]: Connection closed by 159.100.136.21 port 44586 [preauth]
Sep 13 14:12:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 14:12:09 nativespace-cdp sshd[1479874]: Did not receive identification string from 159.100.136.21 port 53762
Sep 13 14:12:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:12:23 nativespace-cdp sudo[1479762]: pam_unix(sudo:session): session closed for user root
Sep 13 14:20:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 14:20:20 nativespace-cdp sshd[1480136]: Did not receive identification string from 159.100.136.21 port 34528
Sep 13 14:20:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:20:35 nativespace-cdp sudo[1480000]: pam_unix(sudo:session): session closed for user root
Sep 13 14:20:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 14:20:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:22:08 nativespace-cdp crond[1480838]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 13 14:22:08 nativespace-cdp crond[1480839]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 13 14:22:08 nativespace-cdp CROND[1480152]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep 13 14:22:24 nativespace-cdp sshd[1480897]: Did not receive identification string from 159.100.136.21 port 43502
Sep 13 14:24:09 nativespace-cdp CROND[1479609]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep 13 14:24:09 nativespace-cdp crond[1480939]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 13 14:24:09 nativespace-cdp CROND[1479604]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep 13 14:24:09 nativespace-cdp CROND[1479601]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep 13 14:24:09 nativespace-cdp crond[1480940]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 13 14:26:40 nativespace-cdp crond[1481040]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 13 14:26:40 nativespace-cdp CROND[1479611]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep 13 14:26:40 nativespace-cdp crond[1481041]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 13 14:26:41 nativespace-cdp sshd[1481279]: Did not receive identification string from 159.100.136.21 port 52528
Sep 13 14:27:25 nativespace-cdp sudo[1480682]: pam_unix(sudo:session): session closed for user root
Sep 13 14:27:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 14:27:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:27:26 nativespace-cdp sudo[1482000]: pam_unix(sudo:session): session closed for user root
Sep 13 14:27:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 14:27:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:16 nativespace-cdp sudo[1482010]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 14:28:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:17 nativespace-cdp sudo[1482579]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 14:28:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:17 nativespace-cdp sudo[1482583]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 14:28:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:17 nativespace-cdp sudo[1482586]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 14:28:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:17 nativespace-cdp sudo[1482589]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 14:28:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:17 nativespace-cdp sudo[1482592]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 14:28:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:17 nativespace-cdp sudo[1482595]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 14:28:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:27 nativespace-cdp sudo[1482626]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 14:28:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:32 nativespace-cdp sudo[1482670]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jonhartl user-2=seftvta user-3=ultbcrra user-4=firstres user-5=coursemc user-6=opaiscyx user-7=firstrel user-8=clarkass user-9=costestimatorco user-10=firstred user-11=southlon user-12=highlegh user-13=gilpin user-14=milloyco user-15=elecleis user-16=putterfi user-17=hubmaster user-18=carsinyo user-19=fetch user-20=accooper user-21=ianrayne user-22=connectedshoppin user-23=thqkgnbz user-24=brighto1 user-25=nstriton user-26=firstre2 user-27=vivienn1 user-28=battlere user-29=oneoarco user-30=bedfords user-31=ggaaorgu user-32=belle user-33=newstoda user-34=bemadonn user-35=alexadmin user-36=skyfirec user-37=innovat1 user-38=askhform user-39=stuartge user-40=nativene user-41=markward user-42=booff user-43=foundation user-44=connect9 user-45=athenare user-46=vantagep user-47=maflemin user-48=lbscrmod
Sep 13 14:28:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=jarvisin user-51=spectrum user-52=hodgesonweb user-53=theblack user-54=still user-55=agproduc user-56=stephani user-57=leereyn1 user-58=brmrjxl user-59=lakesan1 user-60=strathar user-61=sarafoundation user-62=atestord user-63=wilsonsw user-64=musorguk user-65=megacards user-66=martsblo user-67=dickemery123 user-68=ptkxhsbt user-69=lbhyisi user-70=hhdugcor user-71=magichat user-72=tomandle user-73=jennimil user-74=chrisdal user-75=mcdermos user-76=careers user-77=nbhavers user-78=david user-79=attlebor user-80=lucy user-81=onlycont user-82=outdoorc user-83=ranxterc user-84=hodgsonmail user-85=branko user-86=romaldki user-87=nove user-88=boldover user-89=bakery user-90=sosevalu user-91=crrtipdl user-92=tstardom user-93=oubpgvbx user-94=what user-95=cath user-96=sketchy user-97=havantho user-98=nvihkvu user-99=ladburyp user-100=dancinggardener user-101=stagingerris user-102=kategilpin
Sep 13 14:28:32 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=design user-104=asandcoc user-105=sibtoncc user-106=bwppodcast user-107=zebrapho user-108=steve user-109=burydropin user-110=fawcettd user-111=nsceres user-112=beauty user-113=eatspam user-114=darkstar user-115=dhyana user-116=putterfc user-117=nscdp user-118=health2045 user-119=fortunaz user-120=foods user-121=leftie user-122=lkpier user-123=philmcph user-124=ctedorgu user-125=donnychicago user-126=firstre5 user-127=steakbridieme user-128=isleofwi user-129=smrszyqg user-130=hidden user-131=nomistakes user-132=tigerlet user-133=barbersh user-134=cambria1 user-135=cathski user-136=reliable user-137=ninejimm user-138=howardon user-139=pugwash user-140=paulmca1 user-141=cwsocial user-142=hirefootballgame user-143=eugincou user-144=courseme feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 14:28:32 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 14:28:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:33 nativespace-cdp sudo[1482686]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 14:28:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:35 nativespace-cdp sudo[1482694]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-20QWRKVx7BrWsox4.~
Sep 13 14:28:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:36 nativespace-cdp sudo[1482698]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-20QWRKVx7BrWsox4.~'
Sep 13 14:28:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:36 nativespace-cdp sudo[1482701]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-20QWRKVx7BrWsox4.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 14:28:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:36 nativespace-cdp sudo[1482705]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 14:28:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:36 nativespace-cdp sudo[1482708]: pam_unix(sudo:session): session closed for user root
Sep 13 14:28:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 14:28:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 14:28:45 nativespace-cdp sudo[1482853]: pam_unix(sudo:session): session closed for user root
Sep 13 14:31:33 nativespace-cdp sshd[1484339]: Connection closed by 159.100.136.21 port 33442 [preauth]
Sep 13 14:36:37 nativespace-cdp sshd[1485635]: Connection closed by 159.100.136.21 port 42652 [preauth]
Sep 13 14:41:34 nativespace-cdp sshd[1486893]: Connection closed by 159.100.136.21 port 52110 [preauth]
Sep 13 14:46:36 nativespace-cdp sshd[1488755]: Connection closed by 159.100.136.21 port 32964 [preauth]
Sep 13 14:51:35 nativespace-cdp sshd[1489950]: Connection closed by 159.100.136.21 port 42432 [preauth]
Sep 13 14:56:33 nativespace-cdp sshd[1491020]: Connection closed by 159.100.136.21 port 51892 [preauth]
Sep 13 15:01:34 nativespace-cdp sshd[1492842]: Connection closed by 159.100.136.21 port 33120 [preauth]
Sep 13 15:06:33 nativespace-cdp sshd[1493973]: Connection closed by 159.100.136.21 port 41904 [preauth]
Sep 13 15:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 15:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:09:55 nativespace-cdp sudo[1494650]: pam_unix(sudo:session): session closed for user root
Sep 13 15:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 15:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:09:55 nativespace-cdp sudo[1494654]: pam_unix(sudo:session): session closed for user root
Sep 13 15:09:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 15:09:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:09:57 nativespace-cdp sudo[1494657]: pam_unix(sudo:session): session closed for user root
Sep 13 15:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 15:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:09:57 nativespace-cdp sudo[1494664]: pam_unix(sudo:session): session closed for user root
Sep 13 15:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 15:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:01 nativespace-cdp sudo[1494667]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 15:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:01 nativespace-cdp sudo[1494678]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 15:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:01 nativespace-cdp sudo[1494681]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 15:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:01 nativespace-cdp sudo[1494684]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 15:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:01 nativespace-cdp sudo[1494687]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 15:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:01 nativespace-cdp sudo[1494690]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 15:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:01 nativespace-cdp sudo[1494693]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 15:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:06 nativespace-cdp sudo[1494822]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 15:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:16 nativespace-cdp sudo[1494832]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jarvisin user-2=theblack user-3=hodgesonweb user-4=spectrum user-5=still user-6=agproduc user-7=leereyn1 user-8=stephani user-9=foundation user-10=markward user-11=booff user-12=maflemin user-13=lbscrmod user-14=athenare user-15=connect9 user-16=vantagep user-17=ulsukarm user-18=martsblo user-19=ptkxhsbt user-20=dickemery123 user-21=lbhyisi user-22=hhdugcor user-23=magichat user-24=lakesan1 user-25=brmrjxl user-26=sarafoundation user-27=atestord user-28=strathar user-29=wilsonsw user-30=musorguk user-31=megacards user-32=elecleis user-33=gilpin user-34=milloyco user-35=carsinyo user-36=fetch user-37=hubmaster user-38=putterfi user-39=ianrayne user-40=accooper user-41=thqkgnbz user-42=connectedshoppin user-43=firstres user-44=jonhartl user-45=seftvta user-46=ultbcrra user-47=opaiscyx
Sep 13 15:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=coursemc user-49=costestimatorco user-50=clarkass user-51=firstrel user-52=southlon user-53=highlegh user-54=firstred user-55=skyfirec user-56=alexadmin user-57=askhform user-58=stuartge user-59=innovat1 user-60=nativene user-61=brighto1 user-62=nstriton user-63=battlere user-64=oneoarco user-65=firstre2 user-66=vivienn1 user-67=bedfords user-68=bemadonn user-69=belle user-70=ggaaorgu user-71=newstoda user-72=burydropin user-73=fawcettd user-74=nsceres user-75=eatspam user-76=darkstar user-77=beauty user-78=dhyana user-79=sibtoncc user-80=asandcoc user-81=zebrapho user-82=bwppodcast user-83=steve user-84=ninejimm user-85=reliable user-86=cathski user-87=cambria1 user-88=paulmca1 user-89=howardon user-90=pugwash user-91=cwsocial user-92=hirefootballgame user-93=courseme user-94=eugincou user-95=fortunaz user-96=health2045 user-97=foods user-98=leftie user-99=putterfc user-100=nscdp user-101=philmcph
Sep 13 15:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ctedorgu user-103=steakbridieme user-104=donnychicago user-105=firstre5 user-106=lkpier user-107=isleofwi user-108=smrszyqg user-109=barbersh user-110=tigerlet user-111=hidden user-112=nomistakes user-113=attlebor user-114=lucy user-115=onlycont user-116=branko user-117=ranxterc user-118=hodgsonmail user-119=outdoorc user-120=romaldki user-121=tomandle user-122=jennimil user-123=mcdermos user-124=chrisdal user-125=nbhavers user-126=careers user-127=david user-128=what user-129=oubpgvbx user-130=tstardom user-131=nvihkvu user-132=cath user-133=sketchy user-134=havantho user-135=kategilpin user-136=ladburyp user-137=stagingerris user-138=dancinggardener user-139=design user-140=nove user-141=boldover user-142=sosevalu user-143=crrtipdl user-144=bakery feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 15:10:16 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 15:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:18 nativespace-cdp sudo[1494874]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 15:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:19 nativespace-cdp sudo[1494884]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jEsNHdV4lJeNwrGL.~
Sep 13 15:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:19 nativespace-cdp sudo[1494887]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jEsNHdV4lJeNwrGL.~'
Sep 13 15:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:19 nativespace-cdp sudo[1494890]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jEsNHdV4lJeNwrGL.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 15:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:19 nativespace-cdp sudo[1494894]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 15:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:19 nativespace-cdp sudo[1494897]: pam_unix(sudo:session): session closed for user root
Sep 13 15:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 15:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 15:10:40 nativespace-cdp sudo[1494968]: pam_unix(sudo:session): session closed for user root
Sep 13 15:11:33 nativespace-cdp sshd[1495289]: Connection closed by 159.100.136.21 port 51084 [preauth]
Sep 13 15:16:33 nativespace-cdp sshd[1497023]: Connection closed by 159.100.136.21 port 60354 [preauth]
Sep 13 15:21:35 nativespace-cdp sshd[1498209]: Connection closed by 159.100.136.21 port 41598 [preauth]
Sep 13 15:26:35 nativespace-cdp sshd[1499371]: Connection closed by 159.100.136.21 port 50798 [preauth]
Sep 13 15:31:33 nativespace-cdp sshd[1501166]: Connection closed by 159.100.136.21 port 59760 [preauth]
Sep 13 15:36:33 nativespace-cdp sshd[1502298]: Connection closed by 159.100.136.21 port 40372 [preauth]
Sep 13 15:41:34 nativespace-cdp sshd[1503716]: Connection closed by 159.100.136.21 port 49130 [preauth]
Sep 13 15:51:34 nativespace-cdp sshd[1506758]: Connection closed by 159.100.136.21 port 39362 [preauth]
Sep 13 15:56:34 nativespace-cdp sshd[1508014]: Connection closed by 159.100.136.21 port 48886 [preauth]
Sep 13 16:01:34 nativespace-cdp sshd[1509643]: Connection closed by 159.100.136.21 port 58374 [preauth]
Sep 13 16:06:34 nativespace-cdp sshd[1511202]: Connection closed by 159.100.136.21 port 40054 [preauth]
Sep 13 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:09:57 nativespace-cdp sudo[1511928]: pam_unix(sudo:session): session closed for user root
Sep 13 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:09:57 nativespace-cdp sudo[1511932]: pam_unix(sudo:session): session closed for user root
Sep 13 16:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 16:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:16 nativespace-cdp sudo[1511935]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 16:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:16 nativespace-cdp sudo[1512101]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 16:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:45 nativespace-cdp sudo[1512104]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 16:10:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:46 nativespace-cdp sudo[1512246]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 16:10:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:46 nativespace-cdp sudo[1512250]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 16:10:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:46 nativespace-cdp sudo[1512253]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 16:10:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:46 nativespace-cdp sudo[1512256]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 16:10:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:46 nativespace-cdp sudo[1512259]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 16:10:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:46 nativespace-cdp sudo[1512262]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 16:10:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:52 nativespace-cdp sudo[1512286]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 16:10:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:54 nativespace-cdp sudo[1512296]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=lbscrmod user-3=maflemin user-4=vantagep user-5=athenare user-6=connect9 user-7=markward user-8=foundation user-9=booff user-10=leereyn1 user-11=stephani user-12=agproduc user-13=still user-14=theblack user-15=hodgesonweb user-16=spectrum user-17=jarvisin user-18=megacards user-19=musorguk user-20=wilsonsw user-21=atestord user-22=sarafoundation user-23=strathar user-24=brmrjxl user-25=lakesan1 user-26=magichat user-27=hhdugcor user-28=lbhyisi user-29=ptkxhsbt user-30=dickemery123 user-31=martsblo user-32=highlegh user-33=southlon user-34=firstred user-35=costestimatorco user-36=firstrel user-37=clarkass user-38=opaiscyx user-39=coursemc user-40=firstres user-41=ultbcrra user-42=seftvta user-43=jonhartl user-44=thqkgnbz user-45=connectedshoppin user-46=ianrayne user-47=accooper
Sep 13 16:10:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=fetch user-49=carsinyo user-50=putterfi user-51=hubmaster user-52=elecleis user-53=gilpin user-54=milloyco user-55=bemadonn user-56=newstoda user-57=belle user-58=ggaaorgu user-59=bedfords user-60=oneoarco user-61=battlere user-62=vivienn1 user-63=firstre2 user-64=nstriton user-65=brighto1 user-66=nativene user-67=stuartge user-68=askhform user-69=innovat1 user-70=skyfirec user-71=alexadmin user-72=steve user-73=zebrapho user-74=bwppodcast user-75=asandcoc user-76=sibtoncc user-77=dhyana user-78=darkstar user-79=eatspam user-80=beauty user-81=nsceres user-82=fawcettd user-83=burydropin user-84=tigerlet user-85=barbersh user-86=nomistakes user-87=hidden user-88=isleofwi user-89=smrszyqg user-90=steakbridieme user-91=firstre5 user-92=donnychicago user-93=philmcph user-94=ctedorgu user-95=lkpier user-96=leftie user-97=foods user-98=health2045 user-99=fortunaz user-100=nscdp user-101=putterfc
Sep 13 16:10:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=courseme user-103=eugincou user-104=hirefootballgame user-105=cwsocial user-106=paulmca1 user-107=howardon user-108=pugwash user-109=ninejimm user-110=reliable user-111=cathski user-112=cambria1 user-113=david user-114=careers user-115=nbhavers user-116=mcdermos user-117=chrisdal user-118=jennimil user-119=tomandle user-120=romaldki user-121=branko user-122=hodgsonmail user-123=ranxterc user-124=outdoorc user-125=onlycont user-126=lucy user-127=attlebor user-128=crrtipdl user-129=sosevalu user-130=bakery user-131=boldover user-132=nove user-133=design user-134=kategilpin user-135=stagingerris user-136=dancinggardener user-137=ladburyp user-138=nvihkvu user-139=havantho user-140=sketchy user-141=cath user-142=what user-143=oubpgvbx user-144=tstardom feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 16:10:54 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 16:10:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:56 nativespace-cdp sudo[1512304]: pam_unix(sudo:session): session closed for user root
Sep 13 16:10:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 16:10:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:10:59 nativespace-cdp sudo[1512315]: pam_unix(sudo:session): session closed for user root
Sep 13 16:11:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qgT94tz5dmt6M7cw.~
Sep 13 16:11:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:11:00 nativespace-cdp sudo[1512323]: pam_unix(sudo:session): session closed for user root
Sep 13 16:11:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qgT94tz5dmt6M7cw.~'
Sep 13 16:11:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:11:00 nativespace-cdp sudo[1512327]: pam_unix(sudo:session): session closed for user root
Sep 13 16:11:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qgT94tz5dmt6M7cw.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 16:11:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:11:00 nativespace-cdp sudo[1512331]: pam_unix(sudo:session): session closed for user root
Sep 13 16:11:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 16:11:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:11:00 nativespace-cdp sudo[1512336]: pam_unix(sudo:session): session closed for user root
Sep 13 16:11:38 nativespace-cdp sshd[1512514]: Did not receive identification string from 159.100.136.21 port 49726
Sep 13 16:11:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 16:11:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 16:11:53 nativespace-cdp sudo[1512608]: pam_unix(sudo:session): session closed for user root
Sep 13 16:16:36 nativespace-cdp sshd[1514292]: Connection closed by 159.100.136.21 port 59356 [preauth]
Sep 13 16:21:33 nativespace-cdp sshd[1515516]: Connection closed by 159.100.136.21 port 39902 [preauth]
Sep 13 16:26:35 nativespace-cdp sshd[1516716]: Connection closed by 159.100.136.21 port 49092 [preauth]
Sep 13 16:31:34 nativespace-cdp sshd[1518505]: Connection closed by 159.100.136.21 port 58270 [preauth]
Sep 13 16:36:34 nativespace-cdp sshd[1519632]: Connection closed by 159.100.136.21 port 39746 [preauth]
Sep 13 16:41:35 nativespace-cdp sshd[1520828]: Connection closed by 159.100.136.21 port 49384 [preauth]
Sep 13 16:46:34 nativespace-cdp sshd[1522439]: Connection closed by 159.100.136.21 port 59034 [preauth]
Sep 13 16:51:35 nativespace-cdp sshd[1523574]: Connection closed by 159.100.136.21 port 39938 [preauth]
Sep 13 16:56:35 nativespace-cdp sshd[1524953]: Connection closed by 159.100.136.21 port 49092 [preauth]
Sep 13 17:01:34 nativespace-cdp sshd[1526814]: Connection closed by 159.100.136.21 port 57930 [preauth]
Sep 13 17:06:33 nativespace-cdp sshd[1528075]: Connection closed by 159.100.136.21 port 39456 [preauth]
Sep 13 17:08:52 nativespace-cdp sshd[1528581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.179.219.137  user=root
Sep 13 17:08:52 nativespace-cdp sshd[1528581]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:08:54 nativespace-cdp sshd[1528581]: Failed password for root from 118.179.219.137 port 40280 ssh2
Sep 13 17:08:55 nativespace-cdp sshd[1528581]: Received disconnect from 118.179.219.137 port 40280:11: Bye Bye [preauth]
Sep 13 17:08:55 nativespace-cdp sshd[1528581]: Disconnected from 118.179.219.137 port 40280 [preauth]
Sep 13 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:10:00 nativespace-cdp sudo[1528911]: pam_unix(sudo:session): session closed for user root
Sep 13 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:10:00 nativespace-cdp sudo[1528914]: pam_unix(sudo:session): session closed for user root
Sep 13 17:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 17:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:10:21 nativespace-cdp sudo[1528917]: pam_unix(sudo:session): session closed for user root
Sep 13 17:10:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 17:10:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:10:21 nativespace-cdp sudo[1529092]: pam_unix(sudo:session): session closed for user root
Sep 13 17:10:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 17:10:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:10 nativespace-cdp sudo[1529096]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 17:11:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:10 nativespace-cdp sudo[1529357]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 17:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:11 nativespace-cdp sudo[1529360]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 17:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:11 nativespace-cdp sudo[1529364]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 17:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:11 nativespace-cdp sudo[1529367]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 17:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:11 nativespace-cdp sudo[1529370]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 17:11:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:11 nativespace-cdp sudo[1529373]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 17:11:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:20 nativespace-cdp sudo[1529399]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 17:11:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:28 nativespace-cdp sudo[1529405]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=jennimil user-2=tomandle user-3=careers user-4=nbhavers user-5=david user-6=mcdermos user-7=chrisdal user-8=onlycont user-9=attlebor user-10=lucy user-11=romaldki user-12=branko user-13=ranxterc user-14=hodgsonmail user-15=outdoorc user-16=boldover user-17=nove user-18=sosevalu user-19=crrtipdl user-20=bakery user-21=nvihkvu user-22=cath user-23=sketchy user-24=havantho user-25=what user-26=oubpgvbx user-27=tstardom user-28=design user-29=kategilpin user-30=ladburyp user-31=stagingerris user-32=dancinggardener user-33=asandcoc user-34=sibtoncc user-35=steve user-36=zebrapho user-37=bwppodcast user-38=nsceres user-39=burydropin user-40=fawcettd user-41=dhyana user-42=eatspam user-43=darkstar user-44=beauty user-45=ctedorgu user-46=philmcph user-47=steakbridieme user-48=donnychicago
Sep 13 17:11:28 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstre5 user-50=lkpier user-51=health2045 user-52=fortunaz user-53=leftie user-54=foods user-55=putterfc user-56=nscdp user-57=tigerlet user-58=barbersh user-59=hidden user-60=nomistakes user-61=smrszyqg user-62=isleofwi user-63=pugwash user-64=paulmca1 user-65=howardon user-66=cwsocial user-67=ninejimm user-68=reliable user-69=cambria1 user-70=cathski user-71=courseme user-72=eugincou user-73=hirefootballgame user-74=opaiscyx user-75=coursemc user-76=firstres user-77=seftvta user-78=jonhartl user-79=ultbcrra user-80=southlon user-81=highlegh user-82=firstred user-83=costestimatorco user-84=clarkass user-85=firstrel user-86=carsinyo user-87=fetch user-88=hubmaster user-89=putterfi user-90=elecleis user-91=milloyco user-92=gilpin user-93=thqkgnbz user-94=connectedshoppin user-95=ianrayne user-96=accooper user-97=battlere user-98=oneoarco user-99=firstre2 user-100=vivienn1 user-101=brighto1
Sep 13 17:11:28 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=nstriton user-103=bemadonn user-104=ggaaorgu user-105=belle user-106=newstoda user-107=bedfords user-108=skyfirec user-109=alexadmin user-110=nativene user-111=stuartge user-112=askhform user-113=innovat1 user-114=maflemin user-115=lbscrmod user-116=connect9 user-117=athenare user-118=vantagep user-119=foundation user-120=markward user-121=booff user-122=ulsukarm user-123=hodgesonweb user-124=theblack user-125=spectrum user-126=jarvisin user-127=leereyn1 user-128=stephani user-129=still user-130=agproduc user-131=sarafoundation user-132=atestord user-133=strathar user-134=brmrjxl user-135=lakesan1 user-136=musorguk user-137=megacards user-138=wilsonsw user-139=ptkxhsbt user-140=dickemery123 user-141=martsblo user-142=magichat user-143=lbhyisi user-144=hhdugcor feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 13 17:11:28 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 17:11:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:29 nativespace-cdp sudo[1529428]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 17:11:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:31 nativespace-cdp sudo[1529460]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1eYN8dqfK4S70eew.~
Sep 13 17:11:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:31 nativespace-cdp sudo[1529463]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1eYN8dqfK4S70eew.~'
Sep 13 17:11:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:31 nativespace-cdp sudo[1529467]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-1eYN8dqfK4S70eew.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 17:11:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:31 nativespace-cdp sudo[1529472]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 17:11:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:11:31 nativespace-cdp sudo[1529476]: pam_unix(sudo:session): session closed for user root
Sep 13 17:11:35 nativespace-cdp sshd[1529493]: Connection closed by 159.100.136.21 port 48486 [preauth]
Sep 13 17:11:39 nativespace-cdp sshd[1529508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.87.118  user=root
Sep 13 17:11:39 nativespace-cdp sshd[1529508]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:11:39 nativespace-cdp sshd[1529505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.35.197.134  user=root
Sep 13 17:11:39 nativespace-cdp sshd[1529505]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:11:40 nativespace-cdp sshd[1529508]: Failed password for root from 46.101.87.118 port 48818 ssh2
Sep 13 17:11:40 nativespace-cdp sshd[1529505]: Failed password for root from 70.35.197.134 port 38056 ssh2
Sep 13 17:11:41 nativespace-cdp sshd[1529508]: Received disconnect from 46.101.87.118 port 48818:11: Bye Bye [preauth]
Sep 13 17:11:41 nativespace-cdp sshd[1529508]: Disconnected from 46.101.87.118 port 48818 [preauth]
Sep 13 17:11:41 nativespace-cdp sshd[1529505]: Received disconnect from 70.35.197.134 port 38056:11: Bye Bye [preauth]
Sep 13 17:11:41 nativespace-cdp sshd[1529505]: Disconnected from 70.35.197.134 port 38056 [preauth]
Sep 13 17:12:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 17:12:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 17:12:09 nativespace-cdp sudo[1529796]: pam_unix(sudo:session): session closed for user root
Sep 13 17:15:22 nativespace-cdp sshd[1530861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.35.197.134  user=root
Sep 13 17:15:22 nativespace-cdp sshd[1530861]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:15:23 nativespace-cdp sshd[1530861]: Failed password for root from 70.35.197.134 port 53855 ssh2
Sep 13 17:15:23 nativespace-cdp sshd[1530861]: Received disconnect from 70.35.197.134 port 53855:11: Bye Bye [preauth]
Sep 13 17:15:23 nativespace-cdp sshd[1530861]: Disconnected from 70.35.197.134 port 53855 [preauth]
Sep 13 17:15:45 nativespace-cdp sshd[1531003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.87.118  user=root
Sep 13 17:15:45 nativespace-cdp sshd[1531003]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:15:47 nativespace-cdp sshd[1531003]: Failed password for root from 46.101.87.118 port 56240 ssh2
Sep 13 17:15:48 nativespace-cdp sshd[1531003]: Received disconnect from 46.101.87.118 port 56240:11: Bye Bye [preauth]
Sep 13 17:15:48 nativespace-cdp sshd[1531003]: Disconnected from 46.101.87.118 port 56240 [preauth]
Sep 13 17:15:50 nativespace-cdp sshd[1531016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.179.219.137  user=root
Sep 13 17:15:50 nativespace-cdp sshd[1531016]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:15:52 nativespace-cdp sshd[1531016]: Failed password for root from 118.179.219.137 port 33344 ssh2
Sep 13 17:15:52 nativespace-cdp sshd[1531016]: Received disconnect from 118.179.219.137 port 33344:11: Bye Bye [preauth]
Sep 13 17:15:52 nativespace-cdp sshd[1531016]: Disconnected from 118.179.219.137 port 33344 [preauth]
Sep 13 17:16:10 nativespace-cdp sshd[1531091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.35.197.134  user=root
Sep 13 17:16:10 nativespace-cdp sshd[1531091]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:16:11 nativespace-cdp sshd[1531091]: Failed password for root from 70.35.197.134 port 60386 ssh2
Sep 13 17:16:11 nativespace-cdp sshd[1531091]: Received disconnect from 70.35.197.134 port 60386:11: Bye Bye [preauth]
Sep 13 17:16:11 nativespace-cdp sshd[1531091]: Disconnected from 70.35.197.134 port 60386 [preauth]
Sep 13 17:16:27 nativespace-cdp sshd[1531164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.87.118  user=root
Sep 13 17:16:27 nativespace-cdp sshd[1531164]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:16:30 nativespace-cdp sshd[1531164]: Failed password for root from 46.101.87.118 port 39188 ssh2
Sep 13 17:16:30 nativespace-cdp sshd[1531164]: Received disconnect from 46.101.87.118 port 39188:11: Bye Bye [preauth]
Sep 13 17:16:30 nativespace-cdp sshd[1531164]: Disconnected from 46.101.87.118 port 39188 [preauth]
Sep 13 17:16:33 nativespace-cdp sshd[1531218]: Connection closed by 159.100.136.21 port 57870 [preauth]
Sep 13 17:16:48 nativespace-cdp sshd[1531268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.179.219.137  user=root
Sep 13 17:16:48 nativespace-cdp sshd[1531268]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:16:51 nativespace-cdp sshd[1531268]: Failed password for root from 118.179.219.137 port 46136 ssh2
Sep 13 17:16:51 nativespace-cdp sshd[1531268]: Received disconnect from 118.179.219.137 port 46136:11: Bye Bye [preauth]
Sep 13 17:16:51 nativespace-cdp sshd[1531268]: Disconnected from 118.179.219.137 port 46136 [preauth]
Sep 13 17:21:37 nativespace-cdp sshd[1532361]: Connection closed by 159.100.136.21 port 38842 [preauth]
Sep 13 17:26:33 nativespace-cdp sshd[1533481]: Connection closed by 159.100.136.21 port 48340 [preauth]
Sep 13 17:31:33 nativespace-cdp sshd[1534731]: Connection closed by 159.100.136.21 port 57672 [preauth]
Sep 13 17:36:48 nativespace-cdp sshd[1536092]: Did not receive identification string from 159.100.136.21 port 39220
Sep 13 17:43:12 nativespace-cdp CROND[1537161]: pam_systemd(crond:session): Failed to release session: Connection timed out
Sep 13 17:43:15 nativespace-cdp sshd[1537501]: Did not receive identification string from 159.100.136.21 port 48750
Sep 13 17:52:20 nativespace-cdp sshd[1538708]: Did not receive identification string from 159.100.136.21 port 37344
Sep 13 17:52:20 nativespace-cdp sshd[1538558]: Did not receive identification string from 159.100.136.21 port 57708
Sep 13 17:56:34 nativespace-cdp sshd[1541075]: Connection closed by 159.100.136.21 port 47232 [preauth]
Sep 13 17:57:37 nativespace-cdp sshd[1541825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.26.215  user=root
Sep 13 17:57:37 nativespace-cdp sshd[1541825]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 17:57:38 nativespace-cdp sshd[1541825]: Failed password for root from 188.166.26.215 port 44890 ssh2
Sep 13 17:57:45 nativespace-cdp sshd[1541825]: Received disconnect from 188.166.26.215 port 44890:11: Bye Bye [preauth]
Sep 13 17:57:45 nativespace-cdp sshd[1541825]: Disconnected from 188.166.26.215 port 44890 [preauth]
Sep 13 18:00:03 nativespace-cdp sshd[1542476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.125.26.140  user=root
Sep 13 18:00:03 nativespace-cdp sshd[1542476]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:00:05 nativespace-cdp sshd[1542476]: Failed password for root from 186.125.26.140 port 54644 ssh2
Sep 13 18:00:07 nativespace-cdp sshd[1542476]: Received disconnect from 186.125.26.140 port 54644:11: Bye Bye [preauth]
Sep 13 18:00:07 nativespace-cdp sshd[1542476]: Disconnected from 186.125.26.140 port 54644 [preauth]
Sep 13 18:01:15 nativespace-cdp sshd[1543379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.138.0.19  user=root
Sep 13 18:01:15 nativespace-cdp sshd[1543379]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:01:18 nativespace-cdp sshd[1543379]: Failed password for root from 62.138.0.19 port 55498 ssh2
Sep 13 18:01:18 nativespace-cdp sshd[1543379]: Received disconnect from 62.138.0.19 port 55498:11: Bye Bye [preauth]
Sep 13 18:01:18 nativespace-cdp sshd[1543379]: Disconnected from 62.138.0.19 port 55498 [preauth]
Sep 13 18:01:33 nativespace-cdp sshd[1543450]: Connection closed by 159.100.136.21 port 56594 [preauth]
Sep 13 18:03:04 nativespace-cdp sshd[1543679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.109.79  user=root
Sep 13 18:03:04 nativespace-cdp sshd[1543679]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:03:06 nativespace-cdp sshd[1543679]: Failed password for root from 165.227.109.79 port 35068 ssh2
Sep 13 18:03:07 nativespace-cdp sshd[1543679]: Received disconnect from 165.227.109.79 port 35068:11: Bye Bye [preauth]
Sep 13 18:03:07 nativespace-cdp sshd[1543679]: Disconnected from 165.227.109.79 port 35068 [preauth]
Sep 13 18:03:45 nativespace-cdp sshd[1543785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.187.147.32  user=root
Sep 13 18:03:45 nativespace-cdp sshd[1543785]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:03:47 nativespace-cdp sshd[1543785]: Failed password for root from 103.187.147.32 port 50912 ssh2
Sep 13 18:03:48 nativespace-cdp sshd[1543785]: Received disconnect from 103.187.147.32 port 50912:11: Bye Bye [preauth]
Sep 13 18:03:48 nativespace-cdp sshd[1543785]: Disconnected from 103.187.147.32 port 50912 [preauth]
Sep 13 18:03:56 nativespace-cdp sshd[1543873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.109.79  user=root
Sep 13 18:03:56 nativespace-cdp sshd[1543873]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:03:58 nativespace-cdp sshd[1543873]: Failed password for root from 165.227.109.79 port 51262 ssh2
Sep 13 18:03:58 nativespace-cdp sshd[1543873]: Received disconnect from 165.227.109.79 port 51262:11: Bye Bye [preauth]
Sep 13 18:03:58 nativespace-cdp sshd[1543873]: Disconnected from 165.227.109.79 port 51262 [preauth]
Sep 13 18:04:06 nativespace-cdp sshd[1543941]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.138.0.19  user=root
Sep 13 18:04:06 nativespace-cdp sshd[1543941]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:04:08 nativespace-cdp sshd[1543941]: Failed password for root from 62.138.0.19 port 53674 ssh2
Sep 13 18:04:08 nativespace-cdp sshd[1543941]: Received disconnect from 62.138.0.19 port 53674:11: Bye Bye [preauth]
Sep 13 18:04:08 nativespace-cdp sshd[1543941]: Disconnected from 62.138.0.19 port 53674 [preauth]
Sep 13 18:04:09 nativespace-cdp sshd[1543947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.21.123.196  user=root
Sep 13 18:04:09 nativespace-cdp sshd[1543947]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:04:12 nativespace-cdp sshd[1543947]: Failed password for root from 202.21.123.196 port 53148 ssh2
Sep 13 18:04:12 nativespace-cdp sshd[1543947]: Received disconnect from 202.21.123.196 port 53148:11: Bye Bye [preauth]
Sep 13 18:04:12 nativespace-cdp sshd[1543947]: Disconnected from 202.21.123.196 port 53148 [preauth]
Sep 13 18:04:19 nativespace-cdp sshd[1543993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.26.215  user=root
Sep 13 18:04:19 nativespace-cdp sshd[1543993]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:04:21 nativespace-cdp sshd[1543993]: Failed password for root from 188.166.26.215 port 38464 ssh2
Sep 13 18:04:24 nativespace-cdp sshd[1543993]: Received disconnect from 188.166.26.215 port 38464:11: Bye Bye [preauth]
Sep 13 18:04:24 nativespace-cdp sshd[1543993]: Disconnected from 188.166.26.215 port 38464 [preauth]
Sep 13 18:04:42 nativespace-cdp sshd[1544144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.109.79  user=root
Sep 13 18:04:42 nativespace-cdp sshd[1544144]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:04:44 nativespace-cdp sshd[1544144]: Failed password for root from 165.227.109.79 port 38406 ssh2
Sep 13 18:04:44 nativespace-cdp sshd[1544157]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.138.0.19  user=root
Sep 13 18:04:44 nativespace-cdp sshd[1544157]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:04:44 nativespace-cdp sshd[1544144]: Received disconnect from 165.227.109.79 port 38406:11: Bye Bye [preauth]
Sep 13 18:04:44 nativespace-cdp sshd[1544144]: Disconnected from 165.227.109.79 port 38406 [preauth]
Sep 13 18:04:47 nativespace-cdp sshd[1544157]: Failed password for root from 62.138.0.19 port 38476 ssh2
Sep 13 18:04:47 nativespace-cdp sshd[1544157]: Received disconnect from 62.138.0.19 port 38476:11: Bye Bye [preauth]
Sep 13 18:04:47 nativespace-cdp sshd[1544157]: Disconnected from 62.138.0.19 port 38476 [preauth]
Sep 13 18:04:59 nativespace-cdp sshd[1544248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.26.215  user=root
Sep 13 18:04:59 nativespace-cdp sshd[1544248]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:05:01 nativespace-cdp sshd[1544248]: Failed password for root from 188.166.26.215 port 34890 ssh2
Sep 13 18:05:03 nativespace-cdp sshd[1544348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.125.26.140  user=root
Sep 13 18:05:03 nativespace-cdp sshd[1544348]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:05:06 nativespace-cdp sshd[1544348]: Failed password for root from 186.125.26.140 port 35486 ssh2
Sep 13 18:05:06 nativespace-cdp sshd[1544348]: Received disconnect from 186.125.26.140 port 35486:11: Bye Bye [preauth]
Sep 13 18:05:06 nativespace-cdp sshd[1544348]: Disconnected from 186.125.26.140 port 35486 [preauth]
Sep 13 18:05:17 nativespace-cdp sshd[1544457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.21.123.196  user=root
Sep 13 18:05:17 nativespace-cdp sshd[1544457]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:05:18 nativespace-cdp sshd[1544455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.187.147.32  user=root
Sep 13 18:05:18 nativespace-cdp sshd[1544455]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:05:19 nativespace-cdp sshd[1544457]: Failed password for root from 202.21.123.196 port 39926 ssh2
Sep 13 18:05:19 nativespace-cdp sshd[1544457]: Received disconnect from 202.21.123.196 port 39926:11: Bye Bye [preauth]
Sep 13 18:05:19 nativespace-cdp sshd[1544457]: Disconnected from 202.21.123.196 port 39926 [preauth]
Sep 13 18:05:20 nativespace-cdp sshd[1544455]: Failed password for root from 103.187.147.32 port 48236 ssh2
Sep 13 18:05:24 nativespace-cdp sshd[1544455]: Received disconnect from 103.187.147.32 port 48236:11: Bye Bye [preauth]
Sep 13 18:05:24 nativespace-cdp sshd[1544455]: Disconnected from 103.187.147.32 port 48236 [preauth]
Sep 13 18:06:01 nativespace-cdp sshd[1544656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.125.26.140  user=root
Sep 13 18:06:01 nativespace-cdp sshd[1544656]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:06:02 nativespace-cdp sshd[1544672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.21.123.196  user=root
Sep 13 18:06:02 nativespace-cdp sshd[1544672]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:06:03 nativespace-cdp sshd[1544656]: Failed password for root from 186.125.26.140 port 48084 ssh2
Sep 13 18:06:03 nativespace-cdp sshd[1544656]: Received disconnect from 186.125.26.140 port 48084:11: Bye Bye [preauth]
Sep 13 18:06:03 nativespace-cdp sshd[1544656]: Disconnected from 186.125.26.140 port 48084 [preauth]
Sep 13 18:06:04 nativespace-cdp sshd[1544677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.187.147.32  user=root
Sep 13 18:06:04 nativespace-cdp sshd[1544677]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 18:06:04 nativespace-cdp sshd[1544672]: Failed password for root from 202.21.123.196 port 52646 ssh2
Sep 13 18:06:04 nativespace-cdp sshd[1544672]: Received disconnect from 202.21.123.196 port 52646:11: Bye Bye [preauth]
Sep 13 18:06:04 nativespace-cdp sshd[1544672]: Disconnected from 202.21.123.196 port 52646 [preauth]
Sep 13 18:06:06 nativespace-cdp sshd[1544677]: Failed password for root from 103.187.147.32 port 57578 ssh2
Sep 13 18:06:34 nativespace-cdp sshd[1544828]: Connection closed by 159.100.136.21 port 38194 [preauth]
Sep 13 18:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 18:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:09:56 nativespace-cdp sudo[1545593]: pam_unix(sudo:session): session closed for user root
Sep 13 18:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 18:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:09:56 nativespace-cdp sudo[1545597]: pam_unix(sudo:session): session closed for user root
Sep 13 18:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 18:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:01 nativespace-cdp sudo[1545600]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 18:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:01 nativespace-cdp sudo[1545622]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 18:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:13 nativespace-cdp sudo[1545625]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 18:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:13 nativespace-cdp sudo[1545790]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 18:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:13 nativespace-cdp sudo[1545794]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 18:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:13 nativespace-cdp sudo[1545797]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 18:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:14 nativespace-cdp sudo[1545800]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 18:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:14 nativespace-cdp sudo[1545803]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 18:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:14 nativespace-cdp sudo[1545806]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 18:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:19 nativespace-cdp sudo[1545835]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 18:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:23 nativespace-cdp sudo[1545840]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=lucy user-2=attlebor user-3=onlycont user-4=ranxterc user-5=hodgsonmail user-6=outdoorc user-7=branko user-8=romaldki user-9=tomandle user-10=jennimil user-11=chrisdal user-12=mcdermos user-13=david user-14=careers user-15=nbhavers user-16=oubpgvbx user-17=tstardom user-18=what user-19=havantho user-20=sketchy user-21=cath user-22=nvihkvu user-23=stagingerris user-24=dancinggardener user-25=ladburyp user-26=kategilpin user-27=design user-28=nove user-29=boldover user-30=bakery user-31=crrtipdl user-32=sosevalu user-33=fawcettd user-34=burydropin user-35=nsceres user-36=beauty user-37=darkstar user-38=eatspam user-39=dhyana user-40=sibtoncc user-41=asandcoc user-42=bwppodcast user-43=zebrapho user-44=steve user-45=cathski user-46=cambria1 user-47=ninejimm user-48=reliable user-49=cwsocial
Sep 13 18:10:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=howardon user-51=pugwash user-52=paulmca1 user-53=hirefootballgame user-54=eugincou user-55=courseme user-56=nscdp user-57=putterfc user-58=foods user-59=leftie user-60=health2045 user-61=fortunaz user-62=lkpier user-63=steakbridieme user-64=firstre5 user-65=donnychicago user-66=philmcph user-67=ctedorgu user-68=smrszyqg user-69=isleofwi user-70=nomistakes user-71=hidden user-72=tigerlet user-73=barbersh user-74=gilpin user-75=milloyco user-76=elecleis user-77=putterfi user-78=hubmaster user-79=fetch user-80=carsinyo user-81=accooper user-82=ianrayne user-83=connectedshoppin user-84=thqkgnbz user-85=ultbcrra user-86=seftvta user-87=jonhartl user-88=firstres user-89=opaiscyx user-90=coursemc user-91=clarkass user-92=firstrel user-93=costestimatorco user-94=firstred user-95=highlegh user-96=southlon user-97=skyfirec user-98=alexadmin user-99=innovat1 user-100=askhform user-101=stuartge user-102=nativene
Sep 13 18:10:23 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=nstriton user-104=brighto1 user-105=vivienn1 user-106=firstre2 user-107=oneoarco user-108=battlere user-109=bedfords user-110=newstoda user-111=belle user-112=ggaaorgu user-113=bemadonn user-114=jarvisin user-115=spectrum user-116=hodgesonweb user-117=theblack user-118=agproduc user-119=still user-120=stephani user-121=leereyn1 user-122=booff user-123=markward user-124=foundation user-125=vantagep user-126=athenare user-127=connect9 user-128=lbscrmod user-129=maflemin user-130=ulsukarm user-131=martsblo user-132=dickemery123 user-133=ptkxhsbt user-134=hhdugcor user-135=lbhyisi user-136=magichat user-137=brmrjxl user-138=lakesan1 user-139=strathar user-140=atestord user-141=sarafoundation user-142=wilsonsw user-143=megacards user-144=musorguk feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 18:10:23 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 18:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:25 nativespace-cdp sudo[1545859]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 18:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:26 nativespace-cdp sudo[1545866]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-g81JgJ6Mer0BTlRH.~
Sep 13 18:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:26 nativespace-cdp sudo[1545869]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-g81JgJ6Mer0BTlRH.~'
Sep 13 18:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:26 nativespace-cdp sudo[1545873]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-g81JgJ6Mer0BTlRH.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 18:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:26 nativespace-cdp sudo[1545877]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 18:10:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:26 nativespace-cdp sudo[1545880]: pam_unix(sudo:session): session closed for user root
Sep 13 18:10:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 18:10:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 18:10:30 nativespace-cdp sudo[1545901]: pam_unix(sudo:session): session closed for user root
Sep 13 18:16:33 nativespace-cdp sshd[1547899]: Connection closed by 159.100.136.21 port 57330 [preauth]
Sep 13 18:21:33 nativespace-cdp sshd[1548976]: Connection closed by 159.100.136.21 port 38324 [preauth]
Sep 13 18:26:33 nativespace-cdp sshd[1550186]: Connection closed by 159.100.136.21 port 47232 [preauth]
Sep 13 18:31:37 nativespace-cdp sshd[1551572]: Connection closed by 159.100.136.21 port 56814 [preauth]
Sep 13 18:36:33 nativespace-cdp sshd[1552908]: Connection closed by 159.100.136.21 port 36524 [preauth]
Sep 13 18:41:34 nativespace-cdp sshd[1553936]: Connection closed by 159.100.136.21 port 45360 [preauth]
Sep 13 18:46:33 nativespace-cdp sshd[1555416]: Connection closed by 159.100.136.21 port 54490 [preauth]
Sep 13 18:51:34 nativespace-cdp sshd[1556813]: Connection closed by 159.100.136.21 port 35748 [preauth]
Sep 13 18:56:36 nativespace-cdp sshd[1557986]: Connection closed by 159.100.136.21 port 45274 [preauth]
Sep 13 19:01:38 nativespace-cdp sshd[1559687]: Did not receive identification string from 159.100.136.21 port 54648
Sep 13 19:06:34 nativespace-cdp sshd[1560811]: Connection closed by 159.100.136.21 port 36148 [preauth]
Sep 13 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:35 nativespace-cdp sudo[1561244]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:35 nativespace-cdp sudo[1561247]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 19:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:38 nativespace-cdp sudo[1561250]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 19:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:38 nativespace-cdp sudo[1561261]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 19:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:45 nativespace-cdp sudo[1561264]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 19:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:45 nativespace-cdp sudo[1561300]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 19:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:45 nativespace-cdp sudo[1561303]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 19:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:45 nativespace-cdp sudo[1561306]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 19:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:46 nativespace-cdp sudo[1561309]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 19:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:46 nativespace-cdp sudo[1561312]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 19:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:46 nativespace-cdp sudo[1561316]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 19:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:09:53 nativespace-cdp sudo[1561336]: pam_unix(sudo:session): session closed for user root
Sep 13 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:10:00 nativespace-cdp sudo[1561346]: pam_unix(sudo:session): session closed for user root
Sep 13 19:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=onlycont user-2=lucy user-3=attlebor user-4=romaldki user-5=branko user-6=ranxterc user-7=hodgsonmail user-8=outdoorc user-9=jennimil user-10=tomandle user-11=david user-12=nbhavers user-13=careers user-14=mcdermos user-15=chrisdal user-16=nvihkvu user-17=havantho user-18=sketchy user-19=cath user-20=what user-21=oubpgvbx user-22=tstardom user-23=design user-24=kategilpin user-25=dancinggardener user-26=stagingerris user-27=ladburyp user-28=boldover user-29=nove user-30=crrtipdl user-31=sosevalu user-32=bakery user-33=nsceres user-34=fawcettd user-35=burydropin user-36=dhyana user-37=darkstar user-38=eatspam user-39=beauty user-40=sibtoncc user-41=asandcoc user-42=steve user-43=zebrapho user-44=bwppodcast user-45=cwsocial user-46=paulmca1 user-47=howardon user-48=pugwash user-49=reliable
Sep 13 19:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=ninejimm user-51=cathski user-52=cambria1 user-53=courseme user-54=eugincou user-55=hirefootballgame user-56=steakbridieme user-57=firstre5 user-58=donnychicago user-59=philmcph user-60=ctedorgu user-61=lkpier user-62=foods user-63=leftie user-64=health2045 user-65=fortunaz user-66=nscdp user-67=putterfc user-68=tigerlet user-69=barbersh user-70=nomistakes user-71=hidden user-72=isleofwi user-73=smrszyqg user-74=fetch user-75=carsinyo user-76=putterfi user-77=hubmaster user-78=elecleis user-79=milloyco user-80=gilpin user-81=thqkgnbz user-82=connectedshoppin user-83=ianrayne user-84=accooper user-85=opaiscyx user-86=coursemc user-87=firstres user-88=ultbcrra user-89=seftvta user-90=jonhartl user-91=highlegh user-92=southlon user-93=firstred user-94=costestimatorco user-95=clarkass user-96=firstrel user-97=skyfirec user-98=alexadmin user-99=nativene user-100=stuartge user-101=askhform user-102=innovat1
Sep 13 19:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=oneoarco user-104=battlere user-105=vivienn1 user-106=firstre2 user-107=nstriton user-108=brighto1 user-109=bemadonn user-110=newstoda user-111=ggaaorgu user-112=belle user-113=bedfords user-114=hodgesonweb user-115=theblack user-116=spectrum user-117=jarvisin user-118=leereyn1 user-119=stephani user-120=agproduc user-121=still user-122=lbscrmod user-123=maflemin user-124=vantagep user-125=connect9 user-126=athenare user-127=foundation user-128=markward user-129=booff user-130=ulsukarm user-131=ptkxhsbt user-132=dickemery123 user-133=martsblo user-134=magichat user-135=hhdugcor user-136=lbhyisi user-137=atestord user-138=sarafoundation user-139=strathar user-140=brmrjxl user-141=lakesan1 user-142=megacards user-143=musorguk user-144=wilsonsw feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 19:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 19:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:10:03 nativespace-cdp sudo[1561445]: pam_unix(sudo:session): session closed for user root
Sep 13 19:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 19:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:10:06 nativespace-cdp sudo[1561567]: pam_unix(sudo:session): session closed for user root
Sep 13 19:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-TpzmhnMXZ0Gmk4yL.~
Sep 13 19:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:10:07 nativespace-cdp sudo[1561575]: pam_unix(sudo:session): session closed for user root
Sep 13 19:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-TpzmhnMXZ0Gmk4yL.~'
Sep 13 19:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:10:07 nativespace-cdp sudo[1561578]: pam_unix(sudo:session): session closed for user root
Sep 13 19:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-TpzmhnMXZ0Gmk4yL.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 19:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:10:07 nativespace-cdp sudo[1561582]: pam_unix(sudo:session): session closed for user root
Sep 13 19:10:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 19:10:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:10:07 nativespace-cdp sudo[1561586]: pam_unix(sudo:session): session closed for user root
Sep 13 19:10:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 19:10:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 19:10:38 nativespace-cdp sudo[1561709]: pam_unix(sudo:session): session closed for user root
Sep 13 19:11:33 nativespace-cdp sshd[1561965]: Connection closed by 159.100.136.21 port 44956 [preauth]
Sep 13 19:16:06 nativespace-cdp sshd[1563555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.253.40.231  user=root
Sep 13 19:16:06 nativespace-cdp sshd[1563555]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 19:16:08 nativespace-cdp sshd[1563555]: Failed password for root from 222.253.40.231 port 50240 ssh2
Sep 13 19:16:09 nativespace-cdp sshd[1563555]: Received disconnect from 222.253.40.231 port 50240:11: Bye Bye [preauth]
Sep 13 19:16:09 nativespace-cdp sshd[1563555]: Disconnected from 222.253.40.231 port 50240 [preauth]
Sep 13 19:16:34 nativespace-cdp sshd[1563622]: Connection closed by 159.100.136.21 port 54404 [preauth]
Sep 13 19:17:50 nativespace-cdp sshd[1563810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.220.40  user=root
Sep 13 19:17:50 nativespace-cdp sshd[1563810]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 19:17:52 nativespace-cdp sshd[1563810]: Failed password for root from 143.110.220.40 port 52808 ssh2
Sep 13 19:17:52 nativespace-cdp sshd[1563810]: Received disconnect from 143.110.220.40 port 52808:11: Bye Bye [preauth]
Sep 13 19:17:52 nativespace-cdp sshd[1563810]: Disconnected from 143.110.220.40 port 52808 [preauth]
Sep 13 19:19:25 nativespace-cdp sshd[1564055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.220.40  user=root
Sep 13 19:19:25 nativespace-cdp sshd[1564055]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 19:19:27 nativespace-cdp sshd[1564055]: Failed password for root from 143.110.220.40 port 53924 ssh2
Sep 13 19:19:27 nativespace-cdp sshd[1564055]: Received disconnect from 143.110.220.40 port 53924:11: Bye Bye [preauth]
Sep 13 19:19:27 nativespace-cdp sshd[1564055]: Disconnected from 143.110.220.40 port 53924 [preauth]
Sep 13 19:19:56 nativespace-cdp sshd[1564124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.253.40.231  user=root
Sep 13 19:19:56 nativespace-cdp sshd[1564124]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 19:19:58 nativespace-cdp sshd[1564124]: Failed password for root from 222.253.40.231 port 47734 ssh2
Sep 13 19:19:58 nativespace-cdp sshd[1564124]: Received disconnect from 222.253.40.231 port 47734:11: Bye Bye [preauth]
Sep 13 19:19:58 nativespace-cdp sshd[1564124]: Disconnected from 222.253.40.231 port 47734 [preauth]
Sep 13 19:20:04 nativespace-cdp sshd[1564331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.220.40  user=root
Sep 13 19:20:04 nativespace-cdp sshd[1564331]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 19:20:06 nativespace-cdp sshd[1564331]: Failed password for root from 143.110.220.40 port 38750 ssh2
Sep 13 19:20:06 nativespace-cdp sshd[1564331]: Received disconnect from 143.110.220.40 port 38750:11: Bye Bye [preauth]
Sep 13 19:20:06 nativespace-cdp sshd[1564331]: Disconnected from 143.110.220.40 port 38750 [preauth]
Sep 13 19:20:54 nativespace-cdp sshd[1564581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.253.40.231  user=root
Sep 13 19:20:54 nativespace-cdp sshd[1564581]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 19:20:56 nativespace-cdp sshd[1564581]: Failed password for root from 222.253.40.231 port 59658 ssh2
Sep 13 19:20:58 nativespace-cdp sshd[1564581]: Received disconnect from 222.253.40.231 port 59658:11: Bye Bye [preauth]
Sep 13 19:20:58 nativespace-cdp sshd[1564581]: Disconnected from 222.253.40.231 port 59658 [preauth]
Sep 13 19:21:33 nativespace-cdp sshd[1564725]: Connection closed by 159.100.136.21 port 35796 [preauth]
Sep 13 19:26:33 nativespace-cdp sshd[1565854]: Connection closed by 159.100.136.21 port 45432 [preauth]
Sep 13 19:31:35 nativespace-cdp sshd[1567443]: Connection closed by 159.100.136.21 port 54704 [preauth]
Sep 13 19:36:33 nativespace-cdp sshd[1568471]: Connection closed by 159.100.136.21 port 35780 [preauth]
Sep 13 19:41:33 nativespace-cdp sshd[1569575]: Connection closed by 159.100.136.21 port 44606 [preauth]
Sep 13 19:46:33 nativespace-cdp sshd[1570686]: Connection closed by 159.100.136.21 port 53870 [preauth]
Sep 13 19:51:33 nativespace-cdp sshd[1572479]: Connection closed by 159.100.136.21 port 34802 [preauth]
Sep 13 19:56:33 nativespace-cdp sshd[1573654]: Connection closed by 159.100.136.21 port 44266 [preauth]
Sep 13 20:01:33 nativespace-cdp sshd[1575391]: Connection closed by 159.100.136.21 port 53730 [preauth]
Sep 13 20:06:08 nativespace-cdp sshd[1576366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.19.74  user=root
Sep 13 20:06:08 nativespace-cdp sshd[1576366]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 20:06:11 nativespace-cdp sshd[1576366]: Failed password for root from 165.154.19.74 port 50996 ssh2
Sep 13 20:06:11 nativespace-cdp sshd[1576366]: Received disconnect from 165.154.19.74 port 50996:11: Bye Bye [preauth]
Sep 13 20:06:11 nativespace-cdp sshd[1576366]: Disconnected from 165.154.19.74 port 50996 [preauth]
Sep 13 20:06:33 nativespace-cdp sshd[1576492]: Connection closed by 159.100.136.21 port 35070 [preauth]
Sep 13 20:07:52 nativespace-cdp sshd[1576683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.201.225  user=root
Sep 13 20:07:52 nativespace-cdp sshd[1576683]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 20:07:54 nativespace-cdp sshd[1576683]: Failed password for root from 152.32.201.225 port 60708 ssh2
Sep 13 20:07:55 nativespace-cdp sshd[1576683]: Received disconnect from 152.32.201.225 port 60708:11: Bye Bye [preauth]
Sep 13 20:07:55 nativespace-cdp sshd[1576683]: Disconnected from 152.32.201.225 port 60708 [preauth]
Sep 13 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:35 nativespace-cdp sudo[1577007]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:35 nativespace-cdp sudo[1577010]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 20:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:37 nativespace-cdp sudo[1577013]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 20:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:37 nativespace-cdp sudo[1577025]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 20:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:42 nativespace-cdp sudo[1577028]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 20:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:42 nativespace-cdp sudo[1577044]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 20:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:42 nativespace-cdp sudo[1577047]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 20:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:42 nativespace-cdp sudo[1577050]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 20:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:43 nativespace-cdp sudo[1577054]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 20:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:43 nativespace-cdp sudo[1577057]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 20:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:43 nativespace-cdp sudo[1577060]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 20:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:45 nativespace-cdp sudo[1577087]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 20:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:47 nativespace-cdp sudo[1577092]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=stuartge user-2=askhform user-3=innovat1 user-4=nativene user-5=alexadmin user-6=skyfirec user-7=bedfords user-8=bemadonn user-9=newstoda user-10=belle user-11=ggaaorgu user-12=nstriton user-13=brighto1 user-14=oneoarco user-15=battlere user-16=vivienn1 user-17=firstre2 user-18=ianrayne user-19=accooper user-20=thqkgnbz user-21=connectedshoppin user-22=elecleis user-23=milloyco user-24=gilpin user-25=fetch user-26=carsinyo user-27=putterfi user-28=hubmaster user-29=costestimatorco user-30=clarkass user-31=firstrel user-32=highlegh user-33=southlon user-34=firstred user-35=firstres user-36=ultbcrra user-37=jonhartl user-38=seftvta user-39=coursemc user-40=opaiscyx user-41=hhdugcor user-42=lbhyisi user-43=magichat user-44=martsblo user-45=ptkxhsbt user-46=dickemery123 user-47=wilsonsw
Sep 13 20:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=musorguk user-50=brmrjxl user-51=lakesan1 user-52=atestord user-53=sarafoundation user-54=strathar user-55=agproduc user-56=still user-57=leereyn1 user-58=stephani user-59=jarvisin user-60=theblack user-61=hodgesonweb user-62=spectrum user-63=ulsukarm user-64=markward user-65=foundation user-66=booff user-67=lbscrmod user-68=maflemin user-69=vantagep user-70=athenare user-71=connect9 user-72=kategilpin user-73=dancinggardener user-74=stagingerris user-75=ladburyp user-76=design user-77=what user-78=oubpgvbx user-79=tstardom user-80=nvihkvu user-81=havantho user-82=cath user-83=sketchy user-84=crrtipdl user-85=sosevalu user-86=bakery user-87=nove user-88=boldover user-89=branko user-90=ranxterc user-91=hodgsonmail user-92=outdoorc user-93=romaldki user-94=lucy user-95=attlebor user-96=onlycont user-97=mcdermos user-98=chrisdal user-99=david user-100=careers user-101=nbhavers
Sep 13 20:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=tomandle user-103=jennimil user-104=hirefootballgame user-105=courseme user-106=eugincou user-107=ninejimm user-108=reliable user-109=cathski user-110=cambria1 user-111=cwsocial user-112=howardon user-113=pugwash user-114=paulmca1 user-115=smrszyqg user-116=isleofwi user-117=barbersh user-118=tigerlet user-119=nomistakes user-120=hidden user-121=foods user-122=leftie user-123=fortunaz user-124=health2045 user-125=nscdp user-126=putterfc user-127=firstre5 user-128=steakbridieme user-129=donnychicago user-130=philmcph user-131=ctedorgu user-132=lkpier user-133=darkstar user-134=eatspam user-135=beauty user-136=dhyana user-137=fawcettd user-138=burydropin user-139=nsceres user-140=zebrapho user-141=bwppodcast user-142=steve user-143=asandcoc user-144=sibtoncc feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 13 20:09:47 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 20:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:49 nativespace-cdp sudo[1577109]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 20:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:50 nativespace-cdp sudo[1577115]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AOsm6etKuij4HAi0.~
Sep 13 20:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:50 nativespace-cdp sudo[1577119]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AOsm6etKuij4HAi0.~'
Sep 13 20:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:50 nativespace-cdp sudo[1577122]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-AOsm6etKuij4HAi0.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 20:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:50 nativespace-cdp sudo[1577127]: pam_unix(sudo:session): session closed for user root
Sep 13 20:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 20:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:09:50 nativespace-cdp sudo[1577130]: pam_unix(sudo:session): session closed for user root
Sep 13 20:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 20:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 20:10:07 nativespace-cdp sudo[1577294]: pam_unix(sudo:session): session closed for user root
Sep 13 20:11:33 nativespace-cdp sshd[1577813]: Connection closed by 159.100.136.21 port 44472 [preauth]
Sep 13 20:12:49 nativespace-cdp sshd[1577988]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.19.74  user=root
Sep 13 20:12:49 nativespace-cdp sshd[1577988]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 20:12:51 nativespace-cdp sshd[1577988]: Failed password for root from 165.154.19.74 port 51170 ssh2
Sep 13 20:12:51 nativespace-cdp sshd[1577988]: Received disconnect from 165.154.19.74 port 51170:11: Bye Bye [preauth]
Sep 13 20:12:51 nativespace-cdp sshd[1577988]: Disconnected from 165.154.19.74 port 51170 [preauth]
Sep 13 20:13:39 nativespace-cdp sshd[1578113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.201.225  user=root
Sep 13 20:13:39 nativespace-cdp sshd[1578113]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 20:13:41 nativespace-cdp sshd[1578113]: Failed password for root from 152.32.201.225 port 49454 ssh2
Sep 13 20:13:42 nativespace-cdp sshd[1578113]: Received disconnect from 152.32.201.225 port 49454:11: Bye Bye [preauth]
Sep 13 20:13:42 nativespace-cdp sshd[1578113]: Disconnected from 152.32.201.225 port 49454 [preauth]
Sep 13 20:13:49 nativespace-cdp sshd[1578215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.19.74  user=root
Sep 13 20:13:49 nativespace-cdp sshd[1578215]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 20:13:51 nativespace-cdp sshd[1578215]: Failed password for root from 165.154.19.74 port 51216 ssh2
Sep 13 20:13:52 nativespace-cdp sshd[1578215]: Received disconnect from 165.154.19.74 port 51216:11: Bye Bye [preauth]
Sep 13 20:13:52 nativespace-cdp sshd[1578215]: Disconnected from 165.154.19.74 port 51216 [preauth]
Sep 13 20:14:27 nativespace-cdp sshd[1578679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.201.225  user=root
Sep 13 20:14:27 nativespace-cdp sshd[1578679]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 20:14:30 nativespace-cdp sshd[1578679]: Failed password for root from 152.32.201.225 port 62370 ssh2
Sep 13 20:14:30 nativespace-cdp sshd[1578679]: Received disconnect from 152.32.201.225 port 62370:11: Bye Bye [preauth]
Sep 13 20:14:30 nativespace-cdp sshd[1578679]: Disconnected from 152.32.201.225 port 62370 [preauth]
Sep 13 20:16:33 nativespace-cdp sshd[1579329]: Connection closed by 159.100.136.21 port 53644 [preauth]
Sep 13 20:21:36 nativespace-cdp sshd[1580474]: Connection closed by 159.100.136.21 port 34468 [preauth]
Sep 13 20:26:33 nativespace-cdp sshd[1581600]: Connection closed by 159.100.136.21 port 42958 [preauth]
Sep 13 20:31:34 nativespace-cdp sshd[1583250]: Connection closed by 159.100.136.21 port 51882 [preauth]
Sep 13 20:36:33 nativespace-cdp sshd[1584358]: Connection closed by 159.100.136.21 port 59498 [preauth]
Sep 13 20:41:37 nativespace-cdp sshd[1585391]: Connection closed by 159.100.136.21 port 40024 [preauth]
Sep 13 20:43:36 nativespace-cdp sshd[1585715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.0.74  user=root
Sep 13 20:43:36 nativespace-cdp sshd[1585715]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 20:43:38 nativespace-cdp sshd[1585715]: Failed password for root from 103.97.0.74 port 37146 ssh2
Sep 13 20:43:40 nativespace-cdp sshd[1585715]: Received disconnect from 103.97.0.74 port 37146:11: Bye Bye [preauth]
Sep 13 20:43:40 nativespace-cdp sshd[1585715]: Disconnected from 103.97.0.74 port 37146 [preauth]
Sep 13 20:46:33 nativespace-cdp sshd[1587143]: Connection closed by 159.100.136.21 port 49576 [preauth]
Sep 13 20:48:05 nativespace-cdp sshd[1587387]: Connection reset by 103.97.0.74 port 57388 [preauth]
Sep 13 20:48:51 nativespace-cdp sshd[1587513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.0.74  user=root
Sep 13 20:48:51 nativespace-cdp sshd[1587513]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 20:48:52 nativespace-cdp sshd[1587513]: Failed password for root from 103.97.0.74 port 32862 ssh2
Sep 13 20:48:53 nativespace-cdp sshd[1587513]: Received disconnect from 103.97.0.74 port 32862:11: Bye Bye [preauth]
Sep 13 20:48:53 nativespace-cdp sshd[1587513]: Disconnected from 103.97.0.74 port 32862 [preauth]
Sep 13 20:49:41 nativespace-cdp sshd[1587662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.0.74  user=root
Sep 13 20:49:41 nativespace-cdp sshd[1587662]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 13 20:49:43 nativespace-cdp sshd[1587662]: Failed password for root from 103.97.0.74 port 53984 ssh2
Sep 13 20:49:46 nativespace-cdp sshd[1587662]: Received disconnect from 103.97.0.74 port 53984:11: Bye Bye [preauth]
Sep 13 20:49:46 nativespace-cdp sshd[1587662]: Disconnected from 103.97.0.74 port 53984 [preauth]
Sep 13 20:51:33 nativespace-cdp sshd[1588227]: Connection closed by 159.100.136.21 port 58592 [preauth]
Sep 13 20:56:36 nativespace-cdp sshd[1589479]: Connection closed by 159.100.136.21 port 40164 [preauth]
Sep 13 21:01:37 nativespace-cdp sshd[1591181]: Connection closed by 159.100.136.21 port 49628 [preauth]
Sep 13 21:06:33 nativespace-cdp sshd[1592232]: Connection closed by 159.100.136.21 port 59284 [preauth]
Sep 13 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:34 nativespace-cdp sudo[1592737]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:34 nativespace-cdp sudo[1592741]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 21:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:36 nativespace-cdp sudo[1592744]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 21:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:36 nativespace-cdp sudo[1592756]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 21:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:40 nativespace-cdp sudo[1592759]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:40 nativespace-cdp sudo[1592770]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:40 nativespace-cdp sudo[1592773]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 21:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:40 nativespace-cdp sudo[1592776]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:41 nativespace-cdp sudo[1592779]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:41 nativespace-cdp sudo[1592782]: pam_unix(sudo:session): session closed for user root
Sep 13 21:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 21:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:09:41 nativespace-cdp sudo[1592785]: pam_unix(sudo:session): session closed for user root
Sep 13 21:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:10:00 nativespace-cdp sudo[1592828]: pam_unix(sudo:session): session closed for user root
Sep 13 21:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 21:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:10:05 nativespace-cdp sudo[1592834]: pam_unix(sudo:session): session closed for user root
Sep 13 21:10:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=elecleis user-2=milloyco user-3=gilpin user-4=fetch user-5=carsinyo user-6=putterfi user-7=hubmaster user-8=ianrayne user-9=accooper user-10=thqkgnbz user-11=connectedshoppin user-12=firstres user-13=ultbcrra user-14=seftvta user-15=jonhartl user-16=opaiscyx user-17=coursemc user-18=costestimatorco user-19=clarkass user-20=firstrel user-21=highlegh user-22=southlon user-23=firstred user-24=skyfirec user-25=alexadmin user-26=stuartge user-27=askhform user-28=innovat1 user-29=nativene user-30=nstriton user-31=brighto1 user-32=oneoarco user-33=battlere user-34=vivienn1 user-35=firstre2 user-36=bedfords user-37=bemadonn user-38=newstoda user-39=ggaaorgu user-40=belle user-41=jarvisin user-42=theblack user-43=hodgesonweb user-44=spectrum user-45=agproduc user-46=still user-47=leereyn1
Sep 13 21:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=stephani user-49=booff user-50=markward user-51=foundation user-52=lbscrmod user-53=maflemin user-54=vantagep user-55=connect9 user-56=athenare user-57=ulsukarm user-58=martsblo user-59=ptkxhsbt user-60=dickemery123 user-61=hhdugcor user-62=lbhyisi user-63=magichat user-64=brmrjxl user-65=lakesan1 user-66=atestord user-67=sarafoundation user-68=strathar user-69=wilsonsw user-70=megacards user-71=musorguk user-72=lucy user-73=attlebor user-74=onlycont user-75=branko user-76=outdoorc user-77=ranxterc user-78=hodgsonmail user-79=romaldki user-80=tomandle user-81=jennimil user-82=mcdermos user-83=chrisdal user-84=david user-85=nbhavers user-86=careers user-87=what user-88=tstardom user-89=oubpgvbx user-90=nvihkvu user-91=havantho user-92=sketchy user-93=cath user-94=kategilpin user-95=dancinggardener user-96=stagingerris user-97=ladburyp user-98=design user-99=nove user-100=boldover user-101=crrtipdl
Sep 13 21:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=sosevalu user-103=bakery user-104=fawcettd user-105=burydropin user-106=nsceres user-107=darkstar user-108=eatspam user-109=beauty user-110=dhyana user-111=asandcoc user-112=sibtoncc user-113=zebrapho user-114=bwppodcast user-115=steve user-116=reliable user-117=ninejimm user-118=cambria1 user-119=cathski user-120=cwsocial user-121=pugwash user-122=howardon user-123=paulmca1 user-124=hirefootballgame user-125=courseme user-126=eugincou user-127=leftie user-128=foods user-129=fortunaz user-130=health2045 user-131=nscdp user-132=putterfc user-133=donnychicago user-134=steakbridieme user-135=firstre5 user-136=ctedorgu user-137=philmcph user-138=lkpier user-139=isleofwi user-140=smrszyqg user-141=barbersh user-142=tigerlet user-143=nomistakes user-144=hidden feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 13 21:10:05 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 21:10:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:10:07 nativespace-cdp sudo[1592964]: pam_unix(sudo:session): session closed for user root
Sep 13 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:10:08 nativespace-cdp sudo[1592982]: pam_unix(sudo:session): session closed for user root
Sep 13 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4Ra9Ga6gYdJzDJZ9.~
Sep 13 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:10:08 nativespace-cdp sudo[1592985]: pam_unix(sudo:session): session closed for user root
Sep 13 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4Ra9Ga6gYdJzDJZ9.~'
Sep 13 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:10:08 nativespace-cdp sudo[1592988]: pam_unix(sudo:session): session closed for user root
Sep 13 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-4Ra9Ga6gYdJzDJZ9.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:10:08 nativespace-cdp sudo[1592992]: pam_unix(sudo:session): session closed for user root
Sep 13 21:10:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 21:10:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:10:08 nativespace-cdp sudo[1592995]: pam_unix(sudo:session): session closed for user root
Sep 13 21:10:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 21:10:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:10:31 nativespace-cdp sudo[1593089]: pam_unix(sudo:session): session closed for user root
Sep 13 21:11:33 nativespace-cdp sshd[1593418]: Connection closed by 159.100.136.21 port 38570 [preauth]
Sep 13 21:16:33 nativespace-cdp sshd[1594792]: Connection closed by 159.100.136.21 port 47742 [preauth]
Sep 13 21:21:33 nativespace-cdp sshd[1596041]: Connection closed by 159.100.136.21 port 56908 [preauth]
Sep 13 21:26:35 nativespace-cdp sshd[1597101]: Connection closed by 159.100.136.21 port 37960 [preauth]
Sep 13 21:31:37 nativespace-cdp sshd[1598961]: Connection closed by 159.100.136.21 port 46358 [preauth]
Sep 13 21:36:33 nativespace-cdp sshd[1600212]: Connection closed by 159.100.136.21 port 55728 [preauth]
Sep 13 21:42:59 nativespace-cdp sshd[1601434]: Did not receive identification string from 159.100.136.21 port 36374
Sep 13 21:44:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:44:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:04 nativespace-cdp sudo[1601957]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status clarkass
Sep 13 21:44:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:24 nativespace-cdp sudo[1601969]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:44:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:30 nativespace-cdp sudo[1602047]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status clarkass
Sep 13 21:44:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:31 nativespace-cdp sudo[1602051]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:44:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:36 nativespace-cdp sudo[1602075]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status clarkass
Sep 13 21:44:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:37 nativespace-cdp sudo[1602079]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:44:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:38 nativespace-cdp sudo[1602096]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lbhyisi
Sep 13 21:44:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:39 nativespace-cdp sudo[1602100]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:44:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:40 nativespace-cdp sudo[1602122]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lbhyisi
Sep 13 21:44:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:41 nativespace-cdp sudo[1602126]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:44:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:45 nativespace-cdp sudo[1602149]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lbhyisi
Sep 13 21:44:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:46 nativespace-cdp sudo[1602153]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:44:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:47 nativespace-cdp sudo[1602168]: pam_unix(sudo:session): session closed for user root
Sep 13 21:44:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lbhyisi
Sep 13 21:44:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:44:48 nativespace-cdp sudo[1602174]: pam_unix(sudo:session): session closed for user root
Sep 13 21:46:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:46:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:46:15 nativespace-cdp sudo[1602848]: pam_unix(sudo:session): session closed for user root
Sep 13 21:46:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status clarkass
Sep 13 21:46:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:46:17 nativespace-cdp sudo[1602858]: pam_unix(sudo:session): session closed for user root
Sep 13 21:46:33 nativespace-cdp sshd[1603009]: Connection closed by 159.100.136.21 port 45718 [preauth]
Sep 13 21:48:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 21:48:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:48:03 nativespace-cdp sudo[1603426]: pam_unix(sudo:session): session closed for user root
Sep 13 21:48:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lbhyisi
Sep 13 21:48:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 21:48:03 nativespace-cdp sudo[1603430]: pam_unix(sudo:session): session closed for user root
Sep 13 21:51:33 nativespace-cdp sshd[1604647]: Connection closed by 159.100.136.21 port 54980 [preauth]
Sep 13 21:56:35 nativespace-cdp sshd[1605819]: Connection closed by 159.100.136.21 port 35886 [preauth]
Sep 13 22:01:35 nativespace-cdp sshd[1608034]: Connection closed by 159.100.136.21 port 44890 [preauth]
Sep 13 22:06:33 nativespace-cdp sshd[1609133]: Connection closed by 159.100.136.21 port 54292 [preauth]
Sep 13 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:32 nativespace-cdp sudo[1609609]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:32 nativespace-cdp sudo[1609613]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 22:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:37 nativespace-cdp sudo[1609616]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 22:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:37 nativespace-cdp sudo[1609636]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 22:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:42 nativespace-cdp sudo[1609639]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:43 nativespace-cdp sudo[1609663]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:43 nativespace-cdp sudo[1609666]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:43 nativespace-cdp sudo[1609669]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:43 nativespace-cdp sudo[1609672]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:43 nativespace-cdp sudo[1609675]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 22:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:43 nativespace-cdp sudo[1609678]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 22:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:50 nativespace-cdp sudo[1609705]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 22:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:54 nativespace-cdp sudo[1609709]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=fawcettd user-2=burydropin user-3=nsceres user-4=beauty user-5=darkstar user-6=eatspam user-7=dhyana user-8=asandcoc user-9=sibtoncc user-10=bwppodcast user-11=zebrapho user-12=steve user-13=cathski user-14=cambria1 user-15=ninejimm user-16=reliable user-17=cwsocial user-18=howardon user-19=pugwash user-20=paulmca1 user-21=hirefootballgame user-22=eugincou user-23=courseme user-24=nscdp user-25=putterfc user-26=leftie user-27=foods user-28=fortunaz user-29=health2045 user-30=lkpier user-31=firstre5 user-32=steakbridieme user-33=donnychicago user-34=ctedorgu user-35=philmcph user-36=isleofwi user-37=smrszyqg user-38=nomistakes user-39=hidden user-40=barbersh user-41=tigerlet user-42=lucy user-43=attlebor user-44=onlycont user-45=ranxterc user-46=hodgsonmail user-47=outdoorc user-48=branko
Sep 13 22:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=tomandle user-51=jennimil user-52=chrisdal user-53=mcdermos user-54=david user-55=careers user-56=nbhavers user-57=tstardom user-58=oubpgvbx user-59=what user-60=havantho user-61=cath user-62=sketchy user-63=nvihkvu user-64=dancinggardener user-65=stagingerris user-66=ladburyp user-67=kategilpin user-68=design user-69=nove user-70=boldover user-71=bakery user-72=crrtipdl user-73=sosevalu user-74=jarvisin user-75=spectrum user-76=hodgesonweb user-77=theblack user-78=agproduc user-79=still user-80=stephani user-81=leereyn1 user-82=booff user-83=markward user-84=foundation user-85=vantagep user-86=athenare user-87=connect9 user-88=lbscrmod user-89=maflemin user-90=ulsukarm user-91=martsblo user-92=dickemery123 user-93=ptkxhsbt user-94=hhdugcor user-95=lbhyisi user-96=magichat user-97=brmrjxl user-98=lakesan1 user-99=strathar user-100=atestord user-101=sarafoundation user-102=wilsonsw
Sep 13 22:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=megacards user-104=musorguk user-105=gilpin user-106=milloyco user-107=elecleis user-108=putterfi user-109=hubmaster user-110=fetch user-111=carsinyo user-112=accooper user-113=ianrayne user-114=connectedshoppin user-115=thqkgnbz user-116=ultbcrra user-117=jonhartl user-118=seftvta user-119=firstres user-120=opaiscyx user-121=coursemc user-122=firstrel user-123=clarkass user-124=costestimatorco user-125=firstred user-126=highlegh user-127=southlon user-128=alexadmin user-129=skyfirec user-130=innovat1 user-131=askhform user-132=stuartge user-133=nativene user-134=nstriton user-135=brighto1 user-136=vivienn1 user-137=firstre2 user-138=oneoarco user-139=battlere user-140=bedfords user-141=newstoda user-142=belle user-143=ggaaorgu user-144=bemadonn feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 22:09:54 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 22:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:55 nativespace-cdp sudo[1609730]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 22:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:56 nativespace-cdp sudo[1609737]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-up6MjOZnM84fZcbN.~
Sep 13 22:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:56 nativespace-cdp sudo[1609740]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-up6MjOZnM84fZcbN.~'
Sep 13 22:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:56 nativespace-cdp sudo[1609743]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-up6MjOZnM84fZcbN.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 22:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:56 nativespace-cdp sudo[1609747]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 22:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:09:56 nativespace-cdp sudo[1609750]: pam_unix(sudo:session): session closed for user root
Sep 13 22:09:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep 13 22:09:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:10:01 nativespace-cdp sudo[1609756]: pam_unix(sudo:session): session closed for user root
Sep 13 22:10:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 22:10:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 22:10:26 nativespace-cdp sudo[1609972]: pam_unix(sudo:session): session closed for user root
Sep 13 22:11:35 nativespace-cdp sshd[1610282]: Connection closed by 159.100.136.21 port 35288 [preauth]
Sep 13 22:16:33 nativespace-cdp sshd[1611629]: Connection closed by 159.100.136.21 port 44166 [preauth]
Sep 13 22:21:36 nativespace-cdp sshd[1613090]: Connection closed by 159.100.136.21 port 53624 [preauth]
Sep 13 22:26:33 nativespace-cdp sshd[1614045]: Connection closed by 159.100.136.21 port 34782 [preauth]
Sep 13 22:31:33 nativespace-cdp sshd[1615786]: Connection closed by 159.100.136.21 port 43872 [preauth]
Sep 13 22:36:35 nativespace-cdp sshd[1616859]: Connection closed by 159.100.136.21 port 53070 [preauth]
Sep 13 22:41:33 nativespace-cdp sshd[1618055]: Connection closed by 159.100.136.21 port 34358 [preauth]
Sep 13 22:46:33 nativespace-cdp sshd[1619622]: Connection closed by 159.100.136.21 port 43030 [preauth]
Sep 13 22:51:33 nativespace-cdp sshd[1620725]: Connection closed by 159.100.136.21 port 52112 [preauth]
Sep 13 22:56:33 nativespace-cdp sshd[1621744]: Connection closed by 159.100.136.21 port 33082 [preauth]
Sep 13 23:01:33 nativespace-cdp sshd[1623326]: Connection closed by 159.100.136.21 port 42498 [preauth]
Sep 13 23:06:36 nativespace-cdp sshd[1624511]: Connection closed by 159.100.136.21 port 51762 [preauth]
Sep 13 23:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 13 23:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:34 nativespace-cdp sudo[1625174]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 13 23:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:34 nativespace-cdp sudo[1625178]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 13 23:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:39 nativespace-cdp sudo[1625181]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 13 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:39 nativespace-cdp sudo[1625194]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 13 23:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:44 nativespace-cdp sudo[1625197]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 13 23:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:44 nativespace-cdp sudo[1625220]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 13 23:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:44 nativespace-cdp sudo[1625223]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 13 23:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:44 nativespace-cdp sudo[1625226]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 13 23:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:44 nativespace-cdp sudo[1625229]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 13 23:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:44 nativespace-cdp sudo[1625232]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 13 23:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:45 nativespace-cdp sudo[1625236]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 13 23:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:52 nativespace-cdp sudo[1625260]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 13 23:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:58 nativespace-cdp sudo[1625265]: pam_unix(sudo:session): session closed for user root
Sep 13 23:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=magichat user-2=lbhyisi user-3=hhdugcor user-4=ptkxhsbt user-5=dickemery123 user-6=martsblo user-7=musorguk user-8=megacards user-9=wilsonsw user-10=sarafoundation user-11=atestord user-12=strathar user-13=brmrjxl user-14=lakesan1 user-15=leereyn1 user-16=stephani user-17=still user-18=agproduc user-19=theblack user-20=hodgesonweb user-21=spectrum user-22=jarvisin user-23=ulsukarm user-24=maflemin user-25=lbscrmod user-26=connect9 user-27=athenare user-28=vantagep user-29=markward user-30=foundation user-31=booff user-32=nativene user-33=stuartge user-34=askhform user-35=innovat1 user-36=skyfirec user-37=alexadmin user-38=bemadonn user-39=ggaaorgu user-40=belle user-41=newstoda user-42=bedfords user-43=battlere user-44=oneoarco user-45=firstre2 user-46=vivienn1 user-47=brighto1 user-48=nstriton
Sep 13 23:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=thqkgnbz user-50=connectedshoppin user-51=ianrayne user-52=accooper user-53=carsinyo user-54=fetch user-55=hubmaster user-56=putterfi user-57=elecleis user-58=milloyco user-59=gilpin user-60=southlon user-61=highlegh user-62=firstred user-63=costestimatorco user-64=clarkass user-65=firstrel user-66=coursemc user-67=opaiscyx user-68=firstres user-69=jonhartl user-70=seftvta user-71=ultbcrra user-72=courseme user-73=eugincou user-74=hirefootballgame user-75=pugwash user-76=howardon user-77=paulmca1 user-78=cwsocial user-79=reliable user-80=ninejimm user-81=cambria1 user-82=cathski user-83=tigerlet user-84=barbersh user-85=hidden user-86=nomistakes user-87=isleofwi user-88=smrszyqg user-89=philmcph user-90=ctedorgu user-91=firstre5 user-92=steakbridieme user-93=donnychicago user-94=lkpier user-95=fortunaz user-96=health2045 user-97=foods user-98=leftie user-99=putterfc user-100=nscdp user-101=dhyana
Sep 13 23:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=eatspam user-103=darkstar user-104=beauty user-105=nsceres user-106=burydropin user-107=fawcettd user-108=steve user-109=zebrapho user-110=bwppodcast user-111=sibtoncc user-112=asandcoc user-113=design user-114=kategilpin user-115=ladburyp user-116=dancinggardener user-117=stagingerris user-118=nvihkvu user-119=cath user-120=sketchy user-121=havantho user-122=what user-123=oubpgvbx user-124=tstardom user-125=sosevalu user-126=crrtipdl user-127=bakery user-128=boldover user-129=nove user-130=romaldki user-131=branko user-132=ranxterc user-133=hodgsonmail user-134=outdoorc user-135=onlycont user-136=attlebor user-137=lucy user-138=nbhavers user-139=careers user-140=david user-141=mcdermos user-142=chrisdal user-143=jennimil user-144=tomandle feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 13 23:09:58 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 13 23:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:09:59 nativespace-cdp sudo[1625277]: pam_unix(sudo:session): session closed for user root
Sep 13 23:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 23:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:10:00 nativespace-cdp sudo[1625284]: pam_unix(sudo:session): session closed for user root
Sep 13 23:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SOjRWvcoiGxOiKBQ.~
Sep 13 23:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:10:00 nativespace-cdp sudo[1625287]: pam_unix(sudo:session): session closed for user root
Sep 13 23:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SOjRWvcoiGxOiKBQ.~'
Sep 13 23:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:10:00 nativespace-cdp sudo[1625291]: pam_unix(sudo:session): session closed for user root
Sep 13 23:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-SOjRWvcoiGxOiKBQ.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 13 23:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:10:00 nativespace-cdp sudo[1625295]: pam_unix(sudo:session): session closed for user root
Sep 13 23:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 13 23:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:10:00 nativespace-cdp sudo[1625298]: pam_unix(sudo:session): session closed for user root
Sep 13 23:10:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 13 23:10:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 13 23:10:05 nativespace-cdp sudo[1625425]: pam_unix(sudo:session): session closed for user root
Sep 13 23:11:34 nativespace-cdp sshd[1625825]: Connection closed by 159.100.136.21 port 60528 [preauth]
Sep 13 23:16:36 nativespace-cdp sshd[1627471]: Connection closed by 159.100.136.21 port 41824 [preauth]
Sep 13 23:21:34 nativespace-cdp sshd[1628558]: Connection closed by 159.100.136.21 port 50716 [preauth]
Sep 13 23:26:33 nativespace-cdp sshd[1629613]: Connection closed by 159.100.136.21 port 60486 [preauth]
Sep 13 23:31:35 nativespace-cdp sshd[1631274]: Connection closed by 159.100.136.21 port 41326 [preauth]
Sep 13 23:36:35 nativespace-cdp sshd[1632264]: Connection closed by 159.100.136.21 port 50632 [preauth]
Sep 13 23:41:33 nativespace-cdp sshd[1633352]: Connection closed by 159.100.136.21 port 60196 [preauth]
Sep 13 23:46:33 nativespace-cdp sshd[1634972]: Connection closed by 159.100.136.21 port 41490 [preauth]
Sep 13 23:51:34 nativespace-cdp sshd[1636104]: Connection closed by 159.100.136.21 port 51048 [preauth]
Sep 13 23:56:35 nativespace-cdp sshd[1637329]: Connection closed by 159.100.136.21 port 60212 [preauth]
Sep 14 00:01:33 nativespace-cdp sshd[1638959]: Connection closed by 159.100.136.21 port 41356 [preauth]
Sep 14 00:06:33 nativespace-cdp sshd[1640026]: Connection closed by 159.100.136.21 port 51202 [preauth]
Sep 14 00:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 00:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:16 nativespace-cdp sudo[1640545]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 00:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:16 nativespace-cdp sudo[1640550]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 00:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:18 nativespace-cdp sudo[1640554]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 00:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:18 nativespace-cdp sudo[1640565]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 00:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:21 nativespace-cdp sudo[1640571]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:21 nativespace-cdp sudo[1640585]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:21 nativespace-cdp sudo[1640591]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:21 nativespace-cdp sudo[1640595]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:21 nativespace-cdp sudo[1640600]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:21 nativespace-cdp sudo[1640605]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 00:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:21 nativespace-cdp sudo[1640611]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 00:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:24 nativespace-cdp sudo[1640626]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 00:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:25 nativespace-cdp sudo[1640634]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=megacards user-2=musorguk user-3=wilsonsw user-4=strathar user-5=atestord user-6=sarafoundation user-7=brmrjxl user-8=lakesan1 user-9=magichat user-10=hhdugcor user-11=lbhyisi user-12=dickemery123 user-13=ptkxhsbt user-14=martsblo user-15=ulsukarm user-16=vantagep user-17=connect9 user-18=athenare user-19=lbscrmod user-20=maflemin user-21=foundation user-22=markward user-23=booff user-24=stephani user-25=leereyn1 user-26=agproduc user-27=still user-28=spectrum user-29=hodgesonweb user-30=theblack user-31=jarvisin user-32=newstoda user-33=ggaaorgu user-34=belle user-35=bemadonn user-36=bedfords user-37=vivienn1 user-38=firstre2 user-39=oneoarco user-40=battlere user-41=nstriton user-42=brighto1 user-43=nativene user-44=innovat1 user-45=askhform user-46=stuartge user-47=alexadmin user-48=skyfirec
Sep 14 00:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstred user-50=highlegh user-51=southlon user-52=clarkass user-53=firstrel user-54=costestimatorco user-55=coursemc user-56=opaiscyx user-57=ultbcrra user-58=seftvta user-59=jonhartl user-60=firstres user-61=connectedshoppin user-62=thqkgnbz user-63=accooper user-64=ianrayne user-65=hubmaster user-66=putterfi user-67=fetch user-68=carsinyo user-69=gilpin user-70=milloyco user-71=elecleis user-72=nomistakes user-73=hidden user-74=tigerlet user-75=barbersh user-76=smrszyqg user-77=isleofwi user-78=lkpier user-79=steakbridieme user-80=firstre5 user-81=donnychicago user-82=philmcph user-83=ctedorgu user-84=nscdp user-85=putterfc user-86=leftie user-87=foods user-88=fortunaz user-89=health2045 user-90=eugincou user-91=courseme user-92=hirefootballgame user-93=cwsocial user-94=pugwash user-95=howardon user-96=paulmca1 user-97=cambria1 user-98=cathski user-99=reliable user-100=ninejimm user-101=steve
Sep 14 00:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=bwppodcast user-103=zebrapho user-104=asandcoc user-105=sibtoncc user-106=dhyana user-107=beauty user-108=darkstar user-109=eatspam user-110=nsceres user-111=fawcettd user-112=burydropin user-113=bakery user-114=crrtipdl user-115=sosevalu user-116=boldover user-117=nove user-118=design user-119=stagingerris user-120=dancinggardener user-121=ladburyp user-122=kategilpin user-123=havantho user-124=sketchy user-125=cath user-126=nvihkvu user-127=oubpgvbx user-128=tstardom user-129=what user-130=david user-131=nbhavers user-132=careers user-133=chrisdal user-134=mcdermos user-135=jennimil user-136=tomandle user-137=romaldki user-138=ranxterc user-139=hodgsonmail user-140=outdoorc user-141=branko user-142=onlycont user-143=lucy user-144=attlebor feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 00:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 00:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:26 nativespace-cdp sudo[1640642]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 00:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:27 nativespace-cdp sudo[1640654]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-69Ybmi8MaTfEBmic.~
Sep 14 00:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:27 nativespace-cdp sudo[1640660]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-69Ybmi8MaTfEBmic.~'
Sep 14 00:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:27 nativespace-cdp sudo[1640664]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-69Ybmi8MaTfEBmic.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 00:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:27 nativespace-cdp sudo[1640670]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 00:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:27 nativespace-cdp sudo[1640675]: pam_unix(sudo:session): session closed for user root
Sep 14 00:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 00:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 00:09:28 nativespace-cdp sudo[1640698]: pam_unix(sudo:session): session closed for user root
Sep 14 00:11:33 nativespace-cdp sshd[1641198]: Connection closed by 159.100.136.21 port 60706 [preauth]
Sep 14 00:16:33 nativespace-cdp sshd[1642756]: Connection closed by 159.100.136.21 port 41456 [preauth]
Sep 14 00:21:33 nativespace-cdp sshd[1643816]: Connection closed by 159.100.136.21 port 50710 [preauth]
Sep 14 00:26:33 nativespace-cdp sshd[1644813]: Connection closed by 159.100.136.21 port 60260 [preauth]
Sep 14 00:31:34 nativespace-cdp sshd[1646331]: Connection closed by 159.100.136.21 port 41400 [preauth]
Sep 14 00:36:33 nativespace-cdp sshd[1647340]: Connection closed by 159.100.136.21 port 50600 [preauth]
Sep 14 00:41:36 nativespace-cdp sshd[1648333]: Connection closed by 159.100.136.21 port 60096 [preauth]
Sep 14 00:46:36 nativespace-cdp sshd[1649820]: Connection closed by 159.100.136.21 port 40788 [preauth]
Sep 14 00:51:33 nativespace-cdp sshd[1650844]: Connection closed by 159.100.136.21 port 49460 [preauth]
Sep 14 00:56:34 nativespace-cdp sshd[1651793]: Connection closed by 159.100.136.21 port 58054 [preauth]
Sep 14 01:06:35 nativespace-cdp sshd[1654625]: Connection closed by 159.100.136.21 port 46430 [preauth]
Sep 14 01:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 01:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:09 nativespace-cdp sudo[1655205]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 01:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:09 nativespace-cdp sudo[1655209]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 01:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:10 nativespace-cdp sudo[1655212]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 01:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:10 nativespace-cdp sudo[1655229]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 01:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:12 nativespace-cdp sudo[1655232]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:12 nativespace-cdp sudo[1655241]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:12 nativespace-cdp sudo[1655244]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:12 nativespace-cdp sudo[1655247]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:12 nativespace-cdp sudo[1655251]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:12 nativespace-cdp sudo[1655254]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:12 nativespace-cdp sudo[1655257]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 01:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:15 nativespace-cdp sudo[1655274]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 01:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:16 nativespace-cdp sudo[1655278]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=cath user-2=sketchy user-3=havantho user-4=nvihkvu user-5=oubpgvbx user-6=tstardom user-7=what user-8=design user-9=ladburyp user-10=stagingerris user-11=dancinggardener user-12=kategilpin user-13=boldover user-14=nove user-15=bakery user-16=sosevalu user-17=crrtipdl user-18=onlycont user-19=attlebor user-20=lucy user-21=romaldki user-22=outdoorc user-23=ranxterc user-24=hodgsonmail user-25=branko user-26=jennimil user-27=tomandle user-28=careers user-29=nbhavers user-30=david user-31=chrisdal user-32=mcdermos user-33=pugwash user-34=howardon user-35=paulmca1 user-36=cwsocial user-37=cambria1 user-38=cathski user-39=reliable user-40=ninejimm user-41=eugincou user-42=courseme user-43=hirefootballgame user-44=lkpier user-45=philmcph user-46=ctedorgu user-47=steakbridieme user-48=firstre5
Sep 14 01:09:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=donnychicago user-50=putterfc user-51=nscdp user-52=fortunaz user-53=health2045 user-54=leftie user-55=foods user-56=hidden user-57=nomistakes user-58=tigerlet user-59=barbersh user-60=isleofwi user-61=smrszyqg user-62=nsceres user-63=burydropin user-64=fawcettd user-65=dhyana user-66=beauty user-67=eatspam user-68=darkstar user-69=asandcoc user-70=sibtoncc user-71=steve user-72=bwppodcast user-73=zebrapho user-74=skyfirec user-75=alexadmin user-76=nativene user-77=innovat1 user-78=askhform user-79=stuartge user-80=firstre2 user-81=vivienn1 user-82=battlere user-83=oneoarco user-84=brighto1 user-85=nstriton user-86=belle user-87=ggaaorgu user-88=newstoda user-89=bemadonn user-90=bedfords user-91=hubmaster user-92=putterfi user-93=carsinyo user-94=fetch user-95=gilpin user-96=milloyco user-97=elecleis user-98=connectedshoppin user-99=thqkgnbz user-100=accooper user-101=ianrayne user-102=coursemc
Sep 14 01:09:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=opaiscyx user-104=seftvta user-105=jonhartl user-106=ultbcrra user-107=firstres user-108=firstred user-109=southlon user-110=highlegh user-111=clarkass user-112=firstrel user-113=costestimatorco user-114=dickemery123 user-115=ptkxhsbt user-116=martsblo user-117=magichat user-118=lbhyisi user-119=hhdugcor user-120=strathar user-121=sarafoundation user-122=atestord user-123=brmrjxl user-124=lakesan1 user-125=musorguk user-126=megacards user-127=wilsonsw user-128=spectrum user-129=theblack user-130=hodgesonweb user-131=jarvisin user-132=stephani user-133=leereyn1 user-134=still user-135=agproduc user-136=connect9 user-137=athenare user-138=vantagep user-139=maflemin user-140=lbscrmod user-141=markward user-142=booff user-143=foundation user-144=ulsukarm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 01:09:16 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 01:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:16 nativespace-cdp sudo[1655284]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 01:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:17 nativespace-cdp sudo[1655288]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-bMLoeztXYMNndWj2.~
Sep 14 01:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:17 nativespace-cdp sudo[1655291]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-bMLoeztXYMNndWj2.~'
Sep 14 01:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:17 nativespace-cdp sudo[1655294]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-bMLoeztXYMNndWj2.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 01:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:17 nativespace-cdp sudo[1655298]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 01:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:17 nativespace-cdp sudo[1655302]: pam_unix(sudo:session): session closed for user root
Sep 14 01:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 01:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 01:09:23 nativespace-cdp sudo[1655333]: pam_unix(sudo:session): session closed for user root
Sep 14 01:11:33 nativespace-cdp sshd[1655847]: Connection closed by 159.100.136.21 port 55392 [preauth]
Sep 14 01:16:34 nativespace-cdp sshd[1657365]: Connection closed by 159.100.136.21 port 36240 [preauth]
Sep 14 01:21:34 nativespace-cdp sshd[1658381]: Connection closed by 159.100.136.21 port 45006 [preauth]
Sep 14 01:26:33 nativespace-cdp sshd[1659362]: Connection closed by 159.100.136.21 port 54560 [preauth]
Sep 14 01:31:34 nativespace-cdp sshd[1660929]: Connection closed by 159.100.136.21 port 35548 [preauth]
Sep 14 01:36:33 nativespace-cdp sshd[1661903]: Connection closed by 159.100.136.21 port 45242 [preauth]
Sep 14 01:41:34 nativespace-cdp sshd[1662954]: Connection closed by 159.100.136.21 port 54238 [preauth]
Sep 14 01:46:34 nativespace-cdp sshd[1664339]: Connection closed by 159.100.136.21 port 35422 [preauth]
Sep 14 01:51:33 nativespace-cdp sshd[1665589]: Connection closed by 159.100.136.21 port 44090 [preauth]
Sep 14 01:56:33 nativespace-cdp sshd[1666602]: Connection closed by 159.100.136.21 port 53184 [preauth]
Sep 14 02:01:36 nativespace-cdp sshd[1668265]: Connection closed by 159.100.136.21 port 34026 [preauth]
Sep 14 02:06:34 nativespace-cdp sshd[1669321]: Connection closed by 159.100.136.21 port 42898 [preauth]
Sep 14 02:08:56 nativespace-cdp sshd[1669793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.194.60.135  user=root
Sep 14 02:08:56 nativespace-cdp sshd[1669793]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:08:59 nativespace-cdp sshd[1669793]: Failed password for root from 20.194.60.135 port 42516 ssh2
Sep 14 02:08:59 nativespace-cdp sshd[1669793]: Received disconnect from 20.194.60.135 port 42516:11: Bye Bye [preauth]
Sep 14 02:08:59 nativespace-cdp sshd[1669793]: Disconnected from 20.194.60.135 port 42516 [preauth]
Sep 14 02:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 02:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:14 nativespace-cdp sudo[1669861]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 02:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:14 nativespace-cdp sudo[1669864]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 02:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:16 nativespace-cdp sudo[1669867]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 02:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:16 nativespace-cdp sudo[1669878]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 02:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:18 nativespace-cdp sudo[1669881]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:19 nativespace-cdp sudo[1669891]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:19 nativespace-cdp sudo[1669895]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:19 nativespace-cdp sudo[1669898]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:19 nativespace-cdp sudo[1669901]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:19 nativespace-cdp sudo[1669904]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:19 nativespace-cdp sudo[1669907]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 02:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:36 nativespace-cdp sudo[1669945]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 02:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:36 nativespace-cdp sudo[1669952]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=attlebor user-2=lucy user-3=onlycont user-4=branko user-5=hodgsonmail user-6=ranxterc user-7=outdoorc user-8=romaldki user-9=tomandle user-10=jennimil user-11=mcdermos user-12=chrisdal user-13=careers user-14=nbhavers user-15=david user-16=what user-17=oubpgvbx user-18=tstardom user-19=nvihkvu user-20=cath user-21=sketchy user-22=havantho user-23=kategilpin user-24=ladburyp user-25=stagingerris user-26=dancinggardener user-27=design user-28=nove user-29=boldover user-30=sosevalu user-31=crrtipdl user-32=bakery user-33=burydropin user-34=fawcettd user-35=nsceres user-36=eatspam user-37=darkstar user-38=beauty user-39=dhyana user-40=asandcoc user-41=sibtoncc user-42=zebrapho user-43=bwppodcast user-44=steve user-45=reliable user-46=ninejimm user-47=cambria1 user-48=cathski user-49=pugwash
Sep 14 02:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=howardon user-51=paulmca1 user-52=cwsocial user-53=hirefootballgame user-54=courseme user-55=eugincou user-56=fortunaz user-57=health2045 user-58=leftie user-59=foods user-60=putterfc user-61=nscdp user-62=philmcph user-63=ctedorgu user-64=firstre5 user-65=steakbridieme user-66=donnychicago user-67=lkpier user-68=smrszyqg user-69=isleofwi user-70=barbersh user-71=tigerlet user-72=hidden user-73=nomistakes user-74=elecleis user-75=milloyco user-76=gilpin user-77=carsinyo user-78=fetch user-79=hubmaster user-80=putterfi user-81=ianrayne user-82=accooper user-83=thqkgnbz user-84=connectedshoppin user-85=firstres user-86=jonhartl user-87=seftvta user-88=ultbcrra user-89=coursemc user-90=opaiscyx user-91=costestimatorco user-92=firstrel user-93=clarkass user-94=southlon user-95=highlegh user-96=firstred user-97=alexadmin user-98=skyfirec user-99=stuartge user-100=askhform user-101=innovat1 user-102=nativene
Sep 14 02:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=brighto1 user-104=nstriton user-105=battlere user-106=oneoarco user-107=firstre2 user-108=vivienn1 user-109=bedfords user-110=bemadonn user-111=ggaaorgu user-112=belle user-113=newstoda user-114=jarvisin user-115=theblack user-116=hodgesonweb user-117=spectrum user-118=still user-119=agproduc user-120=leereyn1 user-121=stephani user-122=booff user-123=markward user-124=foundation user-125=maflemin user-126=lbscrmod user-127=athenare user-128=connect9 user-129=vantagep user-130=ulsukarm user-131=martsblo user-132=ptkxhsbt user-133=dickemery123 user-134=lbhyisi user-135=hhdugcor user-136=magichat user-137=brmrjxl user-138=lakesan1 user-139=sarafoundation user-140=atestord user-141=strathar user-142=wilsonsw user-143=musorguk user-144=megacards feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 02:09:36 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 02:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:37 nativespace-cdp sudo[1669957]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 02:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:38 nativespace-cdp sudo[1669963]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dAsEmpzZeCr27VH7.~
Sep 14 02:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:38 nativespace-cdp sudo[1669966]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dAsEmpzZeCr27VH7.~'
Sep 14 02:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:38 nativespace-cdp sudo[1669969]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-dAsEmpzZeCr27VH7.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 02:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:38 nativespace-cdp sudo[1669973]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 02:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:38 nativespace-cdp sudo[1669976]: pam_unix(sudo:session): session closed for user root
Sep 14 02:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 02:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 02:09:43 nativespace-cdp sudo[1670012]: pam_unix(sudo:session): session closed for user root
Sep 14 02:11:33 nativespace-cdp sshd[1670462]: Connection closed by 159.100.136.21 port 51670 [preauth]
Sep 14 02:11:43 nativespace-cdp sshd[1670492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.16.245.85  user=root
Sep 14 02:11:43 nativespace-cdp sshd[1670492]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:11:45 nativespace-cdp sshd[1670492]: Failed password for root from 182.16.245.85 port 39304 ssh2
Sep 14 02:11:49 nativespace-cdp sshd[1670492]: Received disconnect from 182.16.245.85 port 39304:11: Bye Bye [preauth]
Sep 14 02:11:49 nativespace-cdp sshd[1670492]: Disconnected from 182.16.245.85 port 39304 [preauth]
Sep 14 02:13:25 nativespace-cdp sshd[1671374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.19.18  user=root
Sep 14 02:13:25 nativespace-cdp sshd[1671374]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:13:27 nativespace-cdp sshd[1671374]: Failed password for root from 14.225.19.18 port 53494 ssh2
Sep 14 02:13:27 nativespace-cdp sshd[1671374]: Received disconnect from 14.225.19.18 port 53494:11: Bye Bye [preauth]
Sep 14 02:13:27 nativespace-cdp sshd[1671374]: Disconnected from 14.225.19.18 port 53494 [preauth]
Sep 14 02:14:30 nativespace-cdp sshd[1671555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.194.60.135  user=root
Sep 14 02:14:30 nativespace-cdp sshd[1671555]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:14:32 nativespace-cdp sshd[1671555]: Failed password for root from 20.194.60.135 port 58346 ssh2
Sep 14 02:14:34 nativespace-cdp sshd[1671555]: Received disconnect from 20.194.60.135 port 58346:11: Bye Bye [preauth]
Sep 14 02:14:34 nativespace-cdp sshd[1671555]: Disconnected from 20.194.60.135 port 58346 [preauth]
Sep 14 02:14:39 nativespace-cdp sshd[1671574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.16.245.85  user=root
Sep 14 02:14:39 nativespace-cdp sshd[1671574]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:14:41 nativespace-cdp sshd[1671574]: Failed password for root from 182.16.245.85 port 36936 ssh2
Sep 14 02:14:41 nativespace-cdp sshd[1671574]: Received disconnect from 182.16.245.85 port 36936:11: Bye Bye [preauth]
Sep 14 02:14:41 nativespace-cdp sshd[1671574]: Disconnected from 182.16.245.85 port 36936 [preauth]
Sep 14 02:15:10 nativespace-cdp sshd[1671783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.19.18  user=root
Sep 14 02:15:10 nativespace-cdp sshd[1671783]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:15:11 nativespace-cdp sshd[1671783]: Failed password for root from 14.225.19.18 port 43284 ssh2
Sep 14 02:15:12 nativespace-cdp sshd[1671783]: Received disconnect from 14.225.19.18 port 43284:11: Bye Bye [preauth]
Sep 14 02:15:12 nativespace-cdp sshd[1671783]: Disconnected from 14.225.19.18 port 43284 [preauth]
Sep 14 02:15:21 nativespace-cdp sshd[1671842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.194.60.135  user=root
Sep 14 02:15:21 nativespace-cdp sshd[1671842]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:15:23 nativespace-cdp sshd[1671842]: Failed password for root from 20.194.60.135 port 45252 ssh2
Sep 14 02:15:23 nativespace-cdp sshd[1671842]: Received disconnect from 20.194.60.135 port 45252:11: Bye Bye [preauth]
Sep 14 02:15:23 nativespace-cdp sshd[1671842]: Disconnected from 20.194.60.135 port 45252 [preauth]
Sep 14 02:15:32 nativespace-cdp sshd[1671898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.16.245.85  user=root
Sep 14 02:15:32 nativespace-cdp sshd[1671898]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:15:35 nativespace-cdp sshd[1671898]: Failed password for root from 182.16.245.85 port 49796 ssh2
Sep 14 02:16:04 nativespace-cdp sshd[1672067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.19.18  user=root
Sep 14 02:16:04 nativespace-cdp sshd[1672067]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:16:05 nativespace-cdp sshd[1672067]: Failed password for root from 14.225.19.18 port 56218 ssh2
Sep 14 02:16:06 nativespace-cdp sshd[1672067]: Received disconnect from 14.225.19.18 port 56218:11: Bye Bye [preauth]
Sep 14 02:16:06 nativespace-cdp sshd[1672067]: Disconnected from 14.225.19.18 port 56218 [preauth]
Sep 14 02:16:35 nativespace-cdp sshd[1672177]: Connection closed by 159.100.136.21 port 60528 [preauth]
Sep 14 02:21:35 nativespace-cdp sshd[1673484]: Connection closed by 159.100.136.21 port 41712 [preauth]
Sep 14 02:26:33 nativespace-cdp sshd[1674662]: Connection closed by 159.100.136.21 port 49778 [preauth]
Sep 14 02:31:34 nativespace-cdp sshd[1676251]: Connection closed by 159.100.136.21 port 57252 [preauth]
Sep 14 02:36:33 nativespace-cdp sshd[1677449]: Connection closed by 159.100.136.21 port 38692 [preauth]
Sep 14 02:41:33 nativespace-cdp sshd[1678625]: Connection closed by 159.100.136.21 port 47356 [preauth]
Sep 14 02:46:33 nativespace-cdp sshd[1679832]: Connection closed by 159.100.136.21 port 56464 [preauth]
Sep 14 02:51:33 nativespace-cdp sshd[1681248]: Connection closed by 159.100.136.21 port 37566 [preauth]
Sep 14 02:51:46 nativespace-cdp sshd[1681279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.223.230.82  user=root
Sep 14 02:51:46 nativespace-cdp sshd[1681279]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:51:47 nativespace-cdp sshd[1681279]: Failed password for root from 189.223.230.82 port 25675 ssh2
Sep 14 02:51:53 nativespace-cdp sshd[1681279]: Received disconnect from 189.223.230.82 port 25675:11: Bye Bye [preauth]
Sep 14 02:51:53 nativespace-cdp sshd[1681279]: Disconnected from 189.223.230.82 port 25675 [preauth]
Sep 14 02:54:29 nativespace-cdp sshd[1681844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.223.230.82  user=root
Sep 14 02:54:29 nativespace-cdp sshd[1681844]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:54:31 nativespace-cdp sshd[1681844]: Failed password for root from 189.223.230.82 port 9727 ssh2
Sep 14 02:54:39 nativespace-cdp sshd[1681844]: Received disconnect from 189.223.230.82 port 9727:11: Bye Bye [preauth]
Sep 14 02:54:39 nativespace-cdp sshd[1681844]: Disconnected from 189.223.230.82 port 9727 [preauth]
Sep 14 02:55:41 nativespace-cdp sshd[1682185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.223.230.82  user=root
Sep 14 02:55:41 nativespace-cdp sshd[1682185]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 02:55:43 nativespace-cdp sshd[1682185]: Failed password for root from 189.223.230.82 port 13511 ssh2
Sep 14 02:55:43 nativespace-cdp sshd[1682185]: Received disconnect from 189.223.230.82 port 13511:11: Bye Bye [preauth]
Sep 14 02:55:43 nativespace-cdp sshd[1682185]: Disconnected from 189.223.230.82 port 13511 [preauth]
Sep 14 02:56:36 nativespace-cdp sshd[1682420]: Connection closed by 159.100.136.21 port 46728 [preauth]
Sep 14 03:01:33 nativespace-cdp sshd[1684048]: Connection closed by 159.100.136.21 port 56040 [preauth]
Sep 14 03:06:36 nativespace-cdp sshd[1685008]: Connection closed by 159.100.136.21 port 37176 [preauth]
Sep 14 03:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 03:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:08 nativespace-cdp sudo[1685547]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 03:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:08 nativespace-cdp sudo[1685551]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 03:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:09 nativespace-cdp sudo[1685554]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 03:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:09 nativespace-cdp sudo[1685559]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 03:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:11 nativespace-cdp sudo[1685562]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:11 nativespace-cdp sudo[1685571]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:11 nativespace-cdp sudo[1685574]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:11 nativespace-cdp sudo[1685577]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:11 nativespace-cdp sudo[1685580]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:11 nativespace-cdp sudo[1685583]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:11 nativespace-cdp sudo[1685586]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 03:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:16 nativespace-cdp sudo[1685609]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 03:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:16 nativespace-cdp sudo[1685616]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=opaiscyx user-2=coursemc user-3=ultbcrra user-4=jonhartl user-5=seftvta user-6=firstres user-7=firstred user-8=highlegh user-9=southlon user-10=firstrel user-11=clarkass user-12=costestimatorco user-13=hubmaster user-14=putterfi user-15=fetch user-16=carsinyo user-17=gilpin user-18=milloyco user-19=elecleis user-20=connectedshoppin user-21=thqkgnbz user-22=accooper user-23=ianrayne user-24=vivienn1 user-25=firstre2 user-26=oneoarco user-27=battlere user-28=nstriton user-29=brighto1 user-30=newstoda user-31=belle user-32=ggaaorgu user-33=bemadonn user-34=bedfords user-35=skyfirec user-36=alexadmin user-37=nativene user-38=innovat1 user-39=stuartge user-40=askhform user-41=vantagep user-42=athenare user-43=connect9 user-44=lbscrmod user-45=maflemin user-46=markward user-47=foundation user-48=booff
Sep 14 03:09:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=spectrum user-51=theblack user-52=hodgesonweb user-53=jarvisin user-54=stephani user-55=leereyn1 user-56=agproduc user-57=still user-58=strathar user-59=atestord user-60=sarafoundation user-61=lakesan1 user-62=brmrjxl user-63=megacards user-64=musorguk user-65=wilsonsw user-66=dickemery123 user-67=ptkxhsbt user-68=martsblo user-69=magichat user-70=hhdugcor user-71=lbhyisi user-72=jennimil user-73=tomandle user-74=david user-75=nbhavers user-76=careers user-77=chrisdal user-78=mcdermos user-79=onlycont user-80=lucy user-81=attlebor user-82=romaldki user-83=hodgsonmail user-84=ranxterc user-85=outdoorc user-86=branko user-87=boldover user-88=nove user-89=bakery user-90=crrtipdl user-91=sosevalu user-92=havantho user-93=sketchy user-94=cath user-95=nvihkvu user-96=oubpgvbx user-97=tstardom user-98=what user-99=design user-100=dancinggardener user-101=stagingerris user-102=ladburyp
Sep 14 03:09:16 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=kategilpin user-104=asandcoc user-105=sibtoncc user-106=steve user-107=bwppodcast user-108=zebrapho user-109=nsceres user-110=fawcettd user-111=burydropin user-112=dhyana user-113=beauty user-114=darkstar user-115=eatspam user-116=lkpier user-117=steakbridieme user-118=donnychicago user-119=firstre5 user-120=philmcph user-121=ctedorgu user-122=nscdp user-123=putterfc user-124=leftie user-125=foods user-126=health2045 user-127=fortunaz user-128=nomistakes user-129=hidden user-130=tigerlet user-131=barbersh user-132=smrszyqg user-133=isleofwi user-134=cwsocial user-135=howardon user-136=paulmca1 user-137=pugwash user-138=cathski user-139=cambria1 user-140=ninejimm user-141=reliable user-142=eugincou user-143=courseme user-144=hirefootballgame feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 03:09:16 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 03:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:17 nativespace-cdp sudo[1685622]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 03:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:17 nativespace-cdp sudo[1685629]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-PyEwmmrAkopjanb4.~
Sep 14 03:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:17 nativespace-cdp sudo[1685632]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-PyEwmmrAkopjanb4.~'
Sep 14 03:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:17 nativespace-cdp sudo[1685635]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-PyEwmmrAkopjanb4.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 03:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:17 nativespace-cdp sudo[1685639]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 03:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:17 nativespace-cdp sudo[1685642]: pam_unix(sudo:session): session closed for user root
Sep 14 03:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 03:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 03:09:24 nativespace-cdp sudo[1685670]: pam_unix(sudo:session): session closed for user root
Sep 14 03:11:36 nativespace-cdp sshd[1686152]: Connection closed by 159.100.136.21 port 46232 [preauth]
Sep 14 03:16:33 nativespace-cdp sshd[1687656]: Connection closed by 159.100.136.21 port 55590 [preauth]
Sep 14 03:21:33 nativespace-cdp sshd[1688642]: Connection closed by 159.100.136.21 port 36534 [preauth]
Sep 14 03:26:33 nativespace-cdp sshd[1689623]: Connection closed by 159.100.136.21 port 46204 [preauth]
Sep 14 03:31:33 nativespace-cdp sshd[1691466]: Connection closed by 159.100.136.21 port 54578 [preauth]
Sep 14 03:34:17 nativespace-cdp sshd[1691973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.153.100  user=root
Sep 14 03:34:17 nativespace-cdp sshd[1691973]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:34:19 nativespace-cdp sshd[1691973]: Failed password for root from 192.241.153.100 port 55250 ssh2
Sep 14 03:34:19 nativespace-cdp sshd[1691973]: Received disconnect from 192.241.153.100 port 55250:11: Bye Bye [preauth]
Sep 14 03:34:19 nativespace-cdp sshd[1691973]: Disconnected from 192.241.153.100 port 55250 [preauth]
Sep 14 03:34:50 nativespace-cdp sshd[1692049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.173.225  user=root
Sep 14 03:34:50 nativespace-cdp sshd[1692049]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:34:52 nativespace-cdp sshd[1692049]: Failed password for root from 40.127.173.225 port 39686 ssh2
Sep 14 03:34:56 nativespace-cdp sshd[1692049]: Received disconnect from 40.127.173.225 port 39686:11: Bye Bye [preauth]
Sep 14 03:34:56 nativespace-cdp sshd[1692049]: Disconnected from 40.127.173.225 port 39686 [preauth]
Sep 14 03:36:33 nativespace-cdp sshd[1692465]: Connection closed by 159.100.136.21 port 36310 [preauth]
Sep 14 03:36:35 nativespace-cdp sshd[1692469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.88.73  user=root
Sep 14 03:36:35 nativespace-cdp sshd[1692469]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:36:37 nativespace-cdp sshd[1692469]: Failed password for root from 138.197.88.73 port 59412 ssh2
Sep 14 03:36:39 nativespace-cdp sshd[1692469]: Received disconnect from 138.197.88.73 port 59412:11: Bye Bye [preauth]
Sep 14 03:36:39 nativespace-cdp sshd[1692469]: Disconnected from 138.197.88.73 port 59412 [preauth]
Sep 14 03:38:16 nativespace-cdp sshd[1692871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.173.225  user=root
Sep 14 03:38:16 nativespace-cdp sshd[1692871]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:38:18 nativespace-cdp sshd[1692871]: Failed password for root from 40.127.173.225 port 47674 ssh2
Sep 14 03:38:18 nativespace-cdp sshd[1692871]: Received disconnect from 40.127.173.225 port 47674:11: Bye Bye [preauth]
Sep 14 03:38:18 nativespace-cdp sshd[1692871]: Disconnected from 40.127.173.225 port 47674 [preauth]
Sep 14 03:38:23 nativespace-cdp sshd[1692888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.153.100  user=root
Sep 14 03:38:23 nativespace-cdp sshd[1692888]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:38:25 nativespace-cdp sshd[1692888]: Failed password for root from 192.241.153.100 port 35650 ssh2
Sep 14 03:38:25 nativespace-cdp sshd[1692888]: Received disconnect from 192.241.153.100 port 35650:11: Bye Bye [preauth]
Sep 14 03:38:25 nativespace-cdp sshd[1692888]: Disconnected from 192.241.153.100 port 35650 [preauth]
Sep 14 03:39:00 nativespace-cdp sshd[1692975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.153.100  user=root
Sep 14 03:39:00 nativespace-cdp sshd[1692975]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:39:02 nativespace-cdp sshd[1692975]: Failed password for root from 192.241.153.100 port 58252 ssh2
Sep 14 03:39:02 nativespace-cdp sshd[1692975]: Received disconnect from 192.241.153.100 port 58252:11: Bye Bye [preauth]
Sep 14 03:39:02 nativespace-cdp sshd[1692975]: Disconnected from 192.241.153.100 port 58252 [preauth]
Sep 14 03:39:03 nativespace-cdp sshd[1692998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.173.225  user=root
Sep 14 03:39:03 nativespace-cdp sshd[1692998]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:39:05 nativespace-cdp sshd[1692998]: Failed password for root from 40.127.173.225 port 48412 ssh2
Sep 14 03:39:11 nativespace-cdp sshd[1693076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.88.73  user=root
Sep 14 03:39:11 nativespace-cdp sshd[1693076]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:39:13 nativespace-cdp sshd[1693076]: Failed password for root from 138.197.88.73 port 54560 ssh2
Sep 14 03:39:13 nativespace-cdp sshd[1693076]: Received disconnect from 138.197.88.73 port 54560:11: Bye Bye [preauth]
Sep 14 03:39:13 nativespace-cdp sshd[1693076]: Disconnected from 138.197.88.73 port 54560 [preauth]
Sep 14 03:39:42 nativespace-cdp sshd[1693220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.88.73  user=root
Sep 14 03:39:42 nativespace-cdp sshd[1693220]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:39:45 nativespace-cdp sshd[1693220]: Failed password for root from 138.197.88.73 port 38172 ssh2
Sep 14 03:41:36 nativespace-cdp sshd[1693710]: Connection closed by 159.100.136.21 port 44936 [preauth]
Sep 14 03:46:36 nativespace-cdp sshd[1695216]: Connection closed by 159.100.136.21 port 52670 [preauth]
Sep 14 03:51:17 nativespace-cdp sshd[1696172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.126.60  user=root
Sep 14 03:51:17 nativespace-cdp sshd[1696172]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:51:19 nativespace-cdp sshd[1696172]: Failed password for root from 157.245.126.60 port 60676 ssh2
Sep 14 03:51:28 nativespace-cdp sshd[1696172]: Received disconnect from 157.245.126.60 port 60676:11: Bye Bye [preauth]
Sep 14 03:51:28 nativespace-cdp sshd[1696172]: Disconnected from 157.245.126.60 port 60676 [preauth]
Sep 14 03:51:34 nativespace-cdp sshd[1696216]: Connection closed by 159.100.136.21 port 33952 [preauth]
Sep 14 03:53:30 nativespace-cdp sshd[1696518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.134.252.37  user=root
Sep 14 03:53:30 nativespace-cdp sshd[1696518]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:53:32 nativespace-cdp sshd[1696518]: Failed password for root from 197.134.252.37 port 44798 ssh2
Sep 14 03:53:32 nativespace-cdp sshd[1696518]: Received disconnect from 197.134.252.37 port 44798:11: Bye Bye [preauth]
Sep 14 03:53:32 nativespace-cdp sshd[1696518]: Disconnected from 197.134.252.37 port 44798 [preauth]
Sep 14 03:54:02 nativespace-cdp sshd[1696590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.196.189  user=root
Sep 14 03:54:02 nativespace-cdp sshd[1696590]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:54:03 nativespace-cdp sshd[1696590]: Failed password for root from 163.44.196.189 port 58532 ssh2
Sep 14 03:54:04 nativespace-cdp sshd[1696590]: Received disconnect from 163.44.196.189 port 58532:11: Bye Bye [preauth]
Sep 14 03:54:04 nativespace-cdp sshd[1696590]: Disconnected from 163.44.196.189 port 58532 [preauth]
Sep 14 03:54:24 nativespace-cdp sshd[1696740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.104.50.153  user=root
Sep 14 03:54:24 nativespace-cdp sshd[1696740]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:54:25 nativespace-cdp sshd[1696740]: Failed password for root from 179.104.50.153 port 14237 ssh2
Sep 14 03:54:27 nativespace-cdp sshd[1696740]: Received disconnect from 179.104.50.153 port 14237:11: Bye Bye [preauth]
Sep 14 03:54:27 nativespace-cdp sshd[1696740]: Disconnected from 179.104.50.153 port 14237 [preauth]
Sep 14 03:55:17 nativespace-cdp sshd[1696987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.189.185.241  user=root
Sep 14 03:55:17 nativespace-cdp sshd[1696987]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:55:19 nativespace-cdp sshd[1696987]: Failed password for root from 196.189.185.241 port 17283 ssh2
Sep 14 03:55:19 nativespace-cdp sshd[1696987]: Received disconnect from 196.189.185.241 port 17283:11: Bye Bye [preauth]
Sep 14 03:55:19 nativespace-cdp sshd[1696987]: Disconnected from 196.189.185.241 port 17283 [preauth]
Sep 14 03:55:21 nativespace-cdp sshd[1697056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.101.135.122  user=root
Sep 14 03:55:21 nativespace-cdp sshd[1697056]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:55:23 nativespace-cdp sshd[1697056]: Failed password for root from 87.101.135.122 port 45230 ssh2
Sep 14 03:55:23 nativespace-cdp sshd[1697062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.164.18.160  user=root
Sep 14 03:55:23 nativespace-cdp sshd[1697062]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:55:23 nativespace-cdp sshd[1697056]: Received disconnect from 87.101.135.122 port 45230:11: Bye Bye [preauth]
Sep 14 03:55:23 nativespace-cdp sshd[1697056]: Disconnected from 87.101.135.122 port 45230 [preauth]
Sep 14 03:55:24 nativespace-cdp sshd[1697062]: Failed password for root from 194.164.18.160 port 52140 ssh2
Sep 14 03:55:24 nativespace-cdp sshd[1697062]: Received disconnect from 194.164.18.160 port 52140:11: Bye Bye [preauth]
Sep 14 03:55:24 nativespace-cdp sshd[1697062]: Disconnected from 194.164.18.160 port 52140 [preauth]
Sep 14 03:56:36 nativespace-cdp sshd[1697229]: Connection closed by 159.100.136.21 port 43790 [preauth]
Sep 14 03:57:51 nativespace-cdp sshd[1697492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.29.135.63  user=root
Sep 14 03:57:51 nativespace-cdp sshd[1697492]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:57:53 nativespace-cdp sshd[1697492]: Failed password for root from 5.29.135.63 port 39128 ssh2
Sep 14 03:57:53 nativespace-cdp sshd[1697492]: Received disconnect from 5.29.135.63 port 39128:11: Bye Bye [preauth]
Sep 14 03:57:53 nativespace-cdp sshd[1697492]: Disconnected from 5.29.135.63 port 39128 [preauth]
Sep 14 03:58:53 nativespace-cdp sshd[1697736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.134.252.37  user=root
Sep 14 03:58:53 nativespace-cdp sshd[1697736]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:58:55 nativespace-cdp sshd[1697736]: Failed password for root from 197.134.252.37 port 49266 ssh2
Sep 14 03:58:55 nativespace-cdp sshd[1697736]: Received disconnect from 197.134.252.37 port 49266:11: Bye Bye [preauth]
Sep 14 03:58:55 nativespace-cdp sshd[1697736]: Disconnected from 197.134.252.37 port 49266 [preauth]
Sep 14 03:59:09 nativespace-cdp sshd[1698124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.164.18.160  user=root
Sep 14 03:59:09 nativespace-cdp sshd[1698124]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:59:11 nativespace-cdp sshd[1698124]: Failed password for root from 194.164.18.160 port 40240 ssh2
Sep 14 03:59:15 nativespace-cdp sshd[1698124]: Received disconnect from 194.164.18.160 port 40240:11: Bye Bye [preauth]
Sep 14 03:59:15 nativespace-cdp sshd[1698124]: Disconnected from 194.164.18.160 port 40240 [preauth]
Sep 14 03:59:15 nativespace-cdp sshd[1698150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.220.69.14  user=root
Sep 14 03:59:15 nativespace-cdp sshd[1698150]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:59:17 nativespace-cdp sshd[1698150]: Failed password for root from 61.220.69.14 port 35748 ssh2
Sep 14 03:59:17 nativespace-cdp sshd[1698150]: Received disconnect from 61.220.69.14 port 35748:11: Bye Bye [preauth]
Sep 14 03:59:17 nativespace-cdp sshd[1698150]: Disconnected from 61.220.69.14 port 35748 [preauth]
Sep 14 03:59:34 nativespace-cdp sshd[1698283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.126.60  user=root
Sep 14 03:59:34 nativespace-cdp sshd[1698283]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:59:36 nativespace-cdp sshd[1698283]: Failed password for root from 157.245.126.60 port 35378 ssh2
Sep 14 03:59:36 nativespace-cdp sshd[1698283]: Received disconnect from 157.245.126.60 port 35378:11: Bye Bye [preauth]
Sep 14 03:59:36 nativespace-cdp sshd[1698283]: Disconnected from 157.245.126.60 port 35378 [preauth]
Sep 14 03:59:37 nativespace-cdp sshd[1698291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.189.185.241  user=root
Sep 14 03:59:37 nativespace-cdp sshd[1698291]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:59:37 nativespace-cdp sshd[1698297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.29.135.63  user=root
Sep 14 03:59:37 nativespace-cdp sshd[1698297]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:59:39 nativespace-cdp sshd[1698291]: Failed password for root from 196.189.185.241 port 17286 ssh2
Sep 14 03:59:39 nativespace-cdp sshd[1698291]: Received disconnect from 196.189.185.241 port 17286:11: Bye Bye [preauth]
Sep 14 03:59:39 nativespace-cdp sshd[1698291]: Disconnected from 196.189.185.241 port 17286 [preauth]
Sep 14 03:59:39 nativespace-cdp sshd[1698297]: Failed password for root from 5.29.135.63 port 56292 ssh2
Sep 14 03:59:39 nativespace-cdp sshd[1698297]: Received disconnect from 5.29.135.63 port 56292:11: Bye Bye [preauth]
Sep 14 03:59:39 nativespace-cdp sshd[1698297]: Disconnected from 5.29.135.63 port 56292 [preauth]
Sep 14 03:59:40 nativespace-cdp sshd[1698303]: Connection closed by 179.104.50.153 port 26460 [preauth]
Sep 14 03:59:48 nativespace-cdp sshd[1698320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.134.252.37  user=root
Sep 14 03:59:48 nativespace-cdp sshd[1698320]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:59:50 nativespace-cdp sshd[1698320]: Failed password for root from 197.134.252.37 port 32796 ssh2
Sep 14 03:59:56 nativespace-cdp sshd[1698366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.164.18.160  user=root
Sep 14 03:59:56 nativespace-cdp sshd[1698366]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 03:59:58 nativespace-cdp sshd[1698366]: Failed password for root from 194.164.18.160 port 55416 ssh2
Sep 14 03:59:58 nativespace-cdp sshd[1698366]: Received disconnect from 194.164.18.160 port 55416:11: Bye Bye [preauth]
Sep 14 03:59:58 nativespace-cdp sshd[1698366]: Disconnected from 194.164.18.160 port 55416 [preauth]
Sep 14 04:00:04 nativespace-cdp sshd[1698583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.101.135.122  user=root
Sep 14 04:00:04 nativespace-cdp sshd[1698583]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:00:06 nativespace-cdp sshd[1698583]: Failed password for root from 87.101.135.122 port 54240 ssh2
Sep 14 04:00:08 nativespace-cdp sshd[1698583]: Received disconnect from 87.101.135.122 port 54240:11: Bye Bye [preauth]
Sep 14 04:00:08 nativespace-cdp sshd[1698583]: Disconnected from 87.101.135.122 port 54240 [preauth]
Sep 14 04:00:14 nativespace-cdp sshd[1698607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.126.60  user=root
Sep 14 04:00:14 nativespace-cdp sshd[1698607]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:00:15 nativespace-cdp sshd[1698610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.196.189  user=root
Sep 14 04:00:15 nativespace-cdp sshd[1698610]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:00:16 nativespace-cdp sshd[1698610]: Failed password for root from 163.44.196.189 port 47110 ssh2
Sep 14 04:00:16 nativespace-cdp sshd[1698607]: Failed password for root from 157.245.126.60 port 60574 ssh2
Sep 14 04:00:19 nativespace-cdp sshd[1698610]: Received disconnect from 163.44.196.189 port 47110:11: Bye Bye [preauth]
Sep 14 04:00:19 nativespace-cdp sshd[1698610]: Disconnected from 163.44.196.189 port 47110 [preauth]
Sep 14 04:00:21 nativespace-cdp sshd[1698623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.220.69.14  user=root
Sep 14 04:00:21 nativespace-cdp sshd[1698623]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:00:21 nativespace-cdp sshd[1698607]: Received disconnect from 157.245.126.60 port 60574:11: Bye Bye [preauth]
Sep 14 04:00:21 nativespace-cdp sshd[1698607]: Disconnected from 157.245.126.60 port 60574 [preauth]
Sep 14 04:00:23 nativespace-cdp sshd[1698623]: Failed password for root from 61.220.69.14 port 25624 ssh2
Sep 14 04:00:23 nativespace-cdp sshd[1698623]: Received disconnect from 61.220.69.14 port 25624:11: Bye Bye [preauth]
Sep 14 04:00:23 nativespace-cdp sshd[1698623]: Disconnected from 61.220.69.14 port 25624 [preauth]
Sep 14 04:00:26 nativespace-cdp sshd[1698710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.104.50.153  user=root
Sep 14 04:00:26 nativespace-cdp sshd[1698710]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:00:28 nativespace-cdp sshd[1698710]: Failed password for root from 179.104.50.153 port 30682 ssh2
Sep 14 04:00:30 nativespace-cdp sshd[1698710]: Received disconnect from 179.104.50.153 port 30682:11: Bye Bye [preauth]
Sep 14 04:00:30 nativespace-cdp sshd[1698710]: Disconnected from 179.104.50.153 port 30682 [preauth]
Sep 14 04:00:33 nativespace-cdp sshd[1698726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.29.135.63  user=root
Sep 14 04:00:33 nativespace-cdp sshd[1698726]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:00:34 nativespace-cdp sshd[1698729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.189.185.241  user=root
Sep 14 04:00:34 nativespace-cdp sshd[1698729]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:00:35 nativespace-cdp sshd[1698726]: Failed password for root from 5.29.135.63 port 59350 ssh2
Sep 14 04:00:35 nativespace-cdp sshd[1698729]: Failed password for root from 196.189.185.241 port 17287 ssh2
Sep 14 04:00:56 nativespace-cdp sshd[1698826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.101.135.122  user=root
Sep 14 04:00:56 nativespace-cdp sshd[1698826]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:00:58 nativespace-cdp sshd[1698826]: Failed password for root from 87.101.135.122 port 39012 ssh2
Sep 14 04:01:01 nativespace-cdp sshd[1698826]: Received disconnect from 87.101.135.122 port 39012:11: Bye Bye [preauth]
Sep 14 04:01:01 nativespace-cdp sshd[1698826]: Disconnected from 87.101.135.122 port 39012 [preauth]
Sep 14 04:01:04 nativespace-cdp sshd[1698894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.196.189  user=root
Sep 14 04:01:04 nativespace-cdp sshd[1698894]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:01:05 nativespace-cdp sshd[1698894]: Failed password for root from 163.44.196.189 port 60116 ssh2
Sep 14 04:01:06 nativespace-cdp sshd[1698942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.220.69.14  user=root
Sep 14 04:01:06 nativespace-cdp sshd[1698942]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:01:08 nativespace-cdp sshd[1698942]: Failed password for root from 61.220.69.14 port 37722 ssh2
Sep 14 04:01:08 nativespace-cdp sshd[1698942]: Received disconnect from 61.220.69.14 port 37722:11: Bye Bye [preauth]
Sep 14 04:01:08 nativespace-cdp sshd[1698942]: Disconnected from 61.220.69.14 port 37722 [preauth]
Sep 14 04:01:17 nativespace-cdp sshd[1699023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.104.50.153  user=root
Sep 14 04:01:17 nativespace-cdp sshd[1699023]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 04:01:19 nativespace-cdp sshd[1699023]: Failed password for root from 179.104.50.153 port 27816 ssh2
Sep 14 04:01:22 nativespace-cdp sshd[1699023]: Received disconnect from 179.104.50.153 port 27816:11: Bye Bye [preauth]
Sep 14 04:01:22 nativespace-cdp sshd[1699023]: Disconnected from 179.104.50.153 port 27816 [preauth]
Sep 14 04:01:33 nativespace-cdp sshd[1699109]: Connection closed by 159.100.136.21 port 52740 [preauth]
Sep 14 04:06:34 nativespace-cdp sshd[1700157]: Connection closed by 159.100.136.21 port 33652 [preauth]
Sep 14 04:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 04:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:15 nativespace-cdp sudo[1700745]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 04:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:15 nativespace-cdp sudo[1700749]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 04:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:15 nativespace-cdp sudo[1700753]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 04:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:15 nativespace-cdp sudo[1700757]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 04:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:17 nativespace-cdp sudo[1700760]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 04:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:17 nativespace-cdp sudo[1700827]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 04:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:17 nativespace-cdp sudo[1700834]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 04:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:17 nativespace-cdp sudo[1700837]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 04:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:17 nativespace-cdp sudo[1700841]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 04:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:17 nativespace-cdp sudo[1700848]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 04:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:17 nativespace-cdp sudo[1700851]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 04:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:19 nativespace-cdp sudo[1700886]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 04:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:20 nativespace-cdp sudo[1700896]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=nove user-2=boldover user-3=sosevalu user-4=crrtipdl user-5=bakery user-6=what user-7=tstardom user-8=oubpgvbx user-9=nvihkvu user-10=cath user-11=sketchy user-12=havantho user-13=kategilpin user-14=ladburyp user-15=stagingerris user-16=dancinggardener user-17=design user-18=tomandle user-19=jennimil user-20=mcdermos user-21=chrisdal user-22=nbhavers user-23=careers user-24=david user-25=attlebor user-26=lucy user-27=onlycont user-28=branko user-29=hodgsonmail user-30=ranxterc user-31=outdoorc user-32=romaldki user-33=health2045 user-34=fortunaz user-35=leftie user-36=foods user-37=putterfc user-38=nscdp user-39=philmcph user-40=ctedorgu user-41=firstre5 user-42=steakbridieme user-43=donnychicago user-44=lkpier user-45=isleofwi user-46=smrszyqg user-47=tigerlet user-48=barbersh user-49=hidden
Sep 14 04:09:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=nomistakes user-51=reliable user-52=ninejimm user-53=cambria1 user-54=cathski user-55=howardon user-56=pugwash user-57=paulmca1 user-58=cwsocial user-59=hirefootballgame user-60=courseme user-61=eugincou user-62=asandcoc user-63=sibtoncc user-64=zebrapho user-65=bwppodcast user-66=steve user-67=burydropin user-68=fawcettd user-69=nsceres user-70=eatspam user-71=darkstar user-72=beauty user-73=dhyana user-74=brighto1 user-75=nstriton user-76=battlere user-77=oneoarco user-78=firstre2 user-79=vivienn1 user-80=bedfords user-81=bemadonn user-82=ggaaorgu user-83=belle user-84=newstoda user-85=skyfirec user-86=alexadmin user-87=stuartge user-88=askhform user-89=innovat1 user-90=nativene user-91=firstres user-92=jonhartl user-93=seftvta user-94=ultbcrra user-95=coursemc user-96=opaiscyx user-97=costestimatorco user-98=clarkass user-99=firstrel user-100=southlon user-101=highlegh user-102=firstred
Sep 14 04:09:20 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=elecleis user-104=gilpin user-105=milloyco user-106=carsinyo user-107=fetch user-108=putterfi user-109=hubmaster user-110=ianrayne user-111=accooper user-112=thqkgnbz user-113=connectedshoppin user-114=lakesan1 user-115=brmrjxl user-116=sarafoundation user-117=atestord user-118=strathar user-119=wilsonsw user-120=musorguk user-121=megacards user-122=martsblo user-123=ptkxhsbt user-124=dickemery123 user-125=lbhyisi user-126=hhdugcor user-127=magichat user-128=markward user-129=booff user-130=foundation user-131=maflemin user-132=lbscrmod user-133=connect9 user-134=athenare user-135=vantagep user-136=ulsukarm user-137=jarvisin user-138=theblack user-139=hodgesonweb user-140=spectrum user-141=still user-142=agproduc user-143=leereyn1 user-144=stephani feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 04:09:20 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 04:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:21 nativespace-cdp sudo[1700901]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 04:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:21 nativespace-cdp sudo[1700908]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8LwiSLnyUaSozA7V.~
Sep 14 04:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:21 nativespace-cdp sudo[1700911]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8LwiSLnyUaSozA7V.~'
Sep 14 04:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:21 nativespace-cdp sudo[1700914]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8LwiSLnyUaSozA7V.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 04:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:21 nativespace-cdp sudo[1700918]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 04:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:21 nativespace-cdp sudo[1700921]: pam_unix(sudo:session): session closed for user root
Sep 14 04:09:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 04:09:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:09:23 nativespace-cdp sudo[1700941]: pam_unix(sudo:session): session closed for user root
Sep 14 04:11:33 nativespace-cdp sshd[1701674]: Connection closed by 159.100.136.21 port 42996 [preauth]
Sep 14 04:16:27 nativespace-cdp sshd[1703239]: Connection closed by 206.168.34.122 port 58542 [preauth]
Sep 14 04:16:33 nativespace-cdp sshd[1703299]: Connection closed by 159.100.136.21 port 52400 [preauth]
Sep 14 04:21:35 nativespace-cdp sshd[1704752]: Connection closed by 159.100.136.21 port 33322 [preauth]
Sep 14 04:26:33 nativespace-cdp sshd[1706454]: Connection closed by 159.100.136.21 port 42934 [preauth]
Sep 14 04:31:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 04:31:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:31:05 nativespace-cdp sudo[1707936]: pam_unix(sudo:session): session closed for user root
Sep 14 04:31:33 nativespace-cdp sshd[1708040]: Connection closed by 159.100.136.21 port 51168 [preauth]
Sep 14 04:36:33 nativespace-cdp sshd[1709240]: Connection closed by 159.100.136.21 port 60122 [preauth]
Sep 14 04:41:33 nativespace-cdp sshd[1711149]: Connection closed by 159.100.136.21 port 40958 [preauth]
Sep 14 04:46:33 nativespace-cdp sshd[1713093]: Connection closed by 159.100.136.21 port 50604 [preauth]
Sep 14 04:51:33 nativespace-cdp sshd[1714222]: Connection closed by 159.100.136.21 port 59386 [preauth]
Sep 14 04:56:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 04:56:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:13 nativespace-cdp sudo[1715228]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 04:56:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:13 nativespace-cdp sudo[1715235]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 04:56:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:17 nativespace-cdp sudo[1715247]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=ulsukarm user-2=athenare user-3=connect9 user-4=vantagep user-5=maflemin user-6=lbscrmod user-7=booff user-8=markward user-9=foundation user-10=stephani user-11=leereyn1 user-12=still user-13=agproduc user-14=spectrum user-15=hodgesonweb user-16=theblack user-17=jarvisin user-18=musorguk user-19=megacards user-20=wilsonsw user-21=strathar user-22=sarafoundation user-23=atestord user-24=lakesan1 user-25=brmrjxl user-26=magichat user-27=lbhyisi user-28=hhdugcor user-29=dickemery123 user-30=ptkxhsbt user-31=martsblo user-32=firstred user-33=southlon user-34=highlegh user-35=clarkass user-36=firstrel user-37=costestimatorco user-38=coursemc user-39=opaiscyx user-40=seftvta user-41=jonhartl user-42=ultbcrra user-43=firstres user-44=connectedshoppin user-45=thqkgnbz user-46=accooper user-47=ianrayne
Sep 14 04:56:17 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=putterfi user-49=hubmaster user-50=carsinyo user-51=fetch user-52=milloyco user-53=gilpin user-54=elecleis user-55=ggaaorgu user-56=belle user-57=newstoda user-58=bemadonn user-59=bedfords user-60=firstre2 user-61=vivienn1 user-62=battlere user-63=oneoarco user-64=brighto1 user-65=nstriton user-66=nativene user-67=innovat1 user-68=stuartge user-69=askhform user-70=skyfirec user-71=alexadmin user-72=steve user-73=bwppodcast user-74=zebrapho user-75=asandcoc user-76=sibtoncc user-77=dhyana user-78=beauty user-79=eatspam user-80=darkstar user-81=nsceres user-82=burydropin user-83=fawcettd user-84=hidden user-85=nomistakes user-86=barbersh user-87=tigerlet user-88=smrszyqg user-89=isleofwi user-90=lkpier user-91=ctedorgu user-92=philmcph user-93=firstre5 user-94=donnychicago user-95=steakbridieme user-96=putterfc user-97=nscdp user-98=fortunaz user-99=health2045 user-100=foods user-101=leftie
Sep 14 04:56:17 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=eugincou user-103=courseme user-104=hirefootballgame user-105=paulmca1 user-106=howardon user-107=pugwash user-108=cwsocial user-109=cathski user-110=cambria1 user-111=ninejimm user-112=reliable user-113=careers user-114=nbhavers user-115=david user-116=chrisdal user-117=mcdermos user-118=jennimil user-119=tomandle user-120=romaldki user-121=ranxterc user-122=outdoorc user-123=hodgsonmail user-124=branko user-125=onlycont user-126=attlebor user-127=lucy user-128=bakery user-129=sosevalu user-130=crrtipdl user-131=boldover user-132=nove user-133=design user-134=ladburyp user-135=stagingerris user-136=dancinggardener user-137=kategilpin user-138=cath user-139=sketchy user-140=havantho user-141=nvihkvu user-142=oubpgvbx user-143=tstardom user-144=what feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 04:56:17 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 04:56:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:18 nativespace-cdp sudo[1715253]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 14 04:56:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:20 nativespace-cdp sudo[1715259]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=onlycont --output=json
Sep 14 04:56:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:20 nativespace-cdp sudo[1715264]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:35 nativespace-cdp sshd[1715319]: Connection closed by 159.100.136.21 port 40578 [preauth]
Sep 14 04:56:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 14 04:56:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 04:56:47 nativespace-cdp sudo[1715410]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 04:56:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user onlycont --user-current --json
Sep 14 04:56:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:48 nativespace-cdp sudo[1715416]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont LangPHP php_get_vhost_versions --output=json
Sep 14 04:56:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:49 nativespace-cdp sudo[1715421]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php82 --output=json
Sep 14 04:56:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:52 nativespace-cdp sudo[1715427]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 14 04:56:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:52 nativespace-cdp sudo[1715437]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DomainInfo single_domain_data domain=apexred.com return_https_redirect_status=1 --output=json
Sep 14 04:56:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:54 nativespace-cdp sudo[1715450]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_vhost_ssl_components --output=json
Sep 14 04:56:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:58 nativespace-cdp sudo[1715459]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 fetch_ssl_vhosts --output=json
Sep 14 04:56:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:59 nativespace-cdp sudo[1715472]: pam_unix(sudo:session): session closed for user root
Sep 14 04:56:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont Mime list_redirects --output=json
Sep 14 04:56:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:56:59 nativespace-cdp sudo[1715479]: pam_unix(sudo:session): session closed for user root
Sep 14 04:57:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=onlycont DirectoryPrivacy is_directory_protected dir=/home/onlycont/public_html/wp --output=json
Sep 14 04:57:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:57:03 nativespace-cdp sudo[1715559]: pam_unix(sudo:session): session closed for user root
Sep 14 04:57:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 14 04:57:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 04:57:06 nativespace-cdp sudo[1715618]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 04:57:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 14 04:57:06 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 14 04:57:06 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 14 04:57:06 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:57:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 04:57:07 nativespace-cdp sudo[1715624]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 04:57:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 14 04:57:07 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 14 04:57:07 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 14 04:57:07 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:57:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 04:57:08 nativespace-cdp sudo[1715632]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 04:57:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 14 04:57:08 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 14 04:57:08 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 14 04:57:08 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:57:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 04:57:10 nativespace-cdp sudo[1715641]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp -maxdepth 1 '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 14 04:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 04:57:19 nativespace-cdp sudo[1715762]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-admin '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 04:57:19 nativespace-cdp sudo[1715769]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-content '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 04:57:19 nativespace-cdp sudo[1715775]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/onlycont/public_html/wp && find /home/onlycont/public_html/wp/wp-includes '(' '(' '(' '(' -type f ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user onlycont ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm
Sep 14 04:57:19 nativespace-cdp sudo: wp-toolkit : (command continued) 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:57:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 04:57:19 nativespace-cdp sudo[1715781]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 04:57:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 14 04:57:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:57:21 nativespace-cdp sudo[1715816]: pam_unix(sudo:session): session closed for user root
Sep 14 04:57:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=oneoarco --output=json
Sep 14 04:57:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:57:22 nativespace-cdp sudo[1715822]: pam_unix(sudo:session): session closed for user root
Sep 14 04:57:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 14 04:57:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 04:57:52 nativespace-cdp sudo[1716036]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 04:57:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 14 04:57:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:57:53 nativespace-cdp sudo[1716042]: pam_unix(sudo:session): session closed for user root
Sep 14 04:57:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco LangPHP php_get_vhost_versions --output=json
Sep 14 04:57:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:57:53 nativespace-cdp sudo[1716046]: pam_unix(sudo:session): session closed for user root
Sep 14 04:57:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=ea-php80 --output=json
Sep 14 04:57:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:57:54 nativespace-cdp sudo[1716051]: pam_unix(sudo:session): session closed for user root
Sep 14 04:57:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 14 04:57:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:57:54 nativespace-cdp sudo[1716061]: pam_unix(sudo:session): session closed for user root
Sep 14 04:57:56 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=oneoar.co.uk return_https_redirect_status=1 --output=json
Sep 14 04:57:56 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:57:57 nativespace-cdp sudo[1716075]: pam_unix(sudo:session): session closed for user root
Sep 14 04:57:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco Mime list_redirects --output=json
Sep 14 04:57:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:57:57 nativespace-cdp sudo[1716082]: pam_unix(sudo:session): session closed for user root
Sep 14 04:58:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html --output=json
Sep 14 04:58:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:58:04 nativespace-cdp sudo[1716193]: pam_unix(sudo:session): session closed for user root
Sep 14 04:58:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 14 04:58:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 04:58:07 nativespace-cdp sudo[1716248]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 04:58:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 14 04:58:07 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 14 04:58:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 14 04:58:07 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:58:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 04:58:08 nativespace-cdp sudo[1716255]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 04:58:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 14 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 14 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 14 04:58:08 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:58:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 04:58:31 nativespace-cdp sudo[1716261]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 04:58:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 14 04:58:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 04:58:41 nativespace-cdp sudo[1716440]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 04:58:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 14 04:58:41 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 14 04:58:41 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 14 04:58:41 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:58:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 04:58:41 nativespace-cdp sudo[1716446]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 04:58:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html && find /home/oneoarco/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')'
Sep 14 04:58:41 nativespace-cdp sudo: wp-toolkit : (command continued) -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o
Sep 14 04:58:41 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o
Sep 14 04:58:41 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:58:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 04:58:41 nativespace-cdp sudo[1716452]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 04:58:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 14 04:58:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:58:44 nativespace-cdp sudo[1716492]: pam_unix(sudo:session): session closed for user root
Sep 14 04:58:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=lkpier --output=json
Sep 14 04:58:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:58:44 nativespace-cdp sudo[1716498]: pam_unix(sudo:session): session closed for user root
Sep 14 04:59:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 14 04:59:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 04:59:22 nativespace-cdp sudo[1716742]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 04:59:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user lkpier --user-current --json
Sep 14 04:59:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:59:23 nativespace-cdp sudo[1716751]: pam_unix(sudo:session): session closed for user root
Sep 14 04:59:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier LangPHP php_get_vhost_versions --output=json
Sep 14 04:59:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:59:23 nativespace-cdp sudo[1716756]: pam_unix(sudo:session): session closed for user root
Sep 14 04:59:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 14 04:59:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:59:23 nativespace-cdp sudo[1716760]: pam_unix(sudo:session): session closed for user root
Sep 14 04:59:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DomainInfo single_domain_data domain=limekilnspier.org.uk return_https_redirect_status=1 --output=json
Sep 14 04:59:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:59:24 nativespace-cdp sudo[1716774]: pam_unix(sudo:session): session closed for user root
Sep 14 04:59:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier Mime list_redirects --output=json
Sep 14 04:59:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:59:24 nativespace-cdp sudo[1716779]: pam_unix(sudo:session): session closed for user root
Sep 14 04:59:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=lkpier DirectoryPrivacy is_directory_protected dir=/home/lkpier/public_html --output=json
Sep 14 04:59:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 04:59:36 nativespace-cdp sudo[1716865]: pam_unix(sudo:session): session closed for user root
Sep 14 04:59:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 14 04:59:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 04:59:38 nativespace-cdp sudo[1716921]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 04:59:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 14 04:59:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 14 04:59:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 14 04:59:38 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:59:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 04:59:39 nativespace-cdp sudo[1716927]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 04:59:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 14 04:59:39 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 14 04:59:39 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 14 04:59:39 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:59:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 04:59:51 nativespace-cdp sudo[1716934]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 04:59:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 14 04:59:51 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 14 04:59:51 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 14 04:59:51 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:59:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 04:59:53 nativespace-cdp sudo[1716970]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html -maxdepth 1 '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 14 04:59:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 04:59:59 nativespace-cdp sudo[1717081]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-admin '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:59:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 04:59:59 nativespace-cdp sudo[1717087]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-content '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:59:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 04:59:59 nativespace-cdp sudo[1717095]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/lkpier/public_html && find /home/lkpier/public_html/wp-includes '(' '(' '(' '(' -type f ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user lkpier ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o '(' -perm 045 ')' -o '(' -perm 050 ')' -o '('
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o '(' -perm 315 ')' -o '(' -perm 340 ')' -o '('
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o '(' -perm 605 ')' -o '(' -perm 610 ')' -o '('
Sep 14 04:59:59 nativespace-cdp sudo: wp-toolkit : (command continued) -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 04:59:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 04:59:59 nativespace-cdp sudo[1717101]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 05:00:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 14 05:00:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:02 nativespace-cdp sudo[1717249]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=bwppodcast --output=json
Sep 14 05:00:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:02 nativespace-cdp sudo[1717299]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast DomainInfo single_domain_data domain=bakewithpassion.com return_https_redirect_status=1 --output=json
Sep 14 05:00:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:04 nativespace-cdp sudo[1717328]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast Mime list_redirects --output=json
Sep 14 05:00:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:04 nativespace-cdp sudo[1717337]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/bwppodcast/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 14 05:00:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 14 05:00:05 nativespace-cdp sudo[1717350]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 14 05:00:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user bwppodcast --user-current --json
Sep 14 05:00:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:06 nativespace-cdp sudo[1717356]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=bwppodcast LangPHP php_get_vhost_versions --output=json
Sep 14 05:00:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:06 nativespace-cdp sudo[1717362]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 14 05:00:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:06 nativespace-cdp sudo[1717366]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 14 05:00:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 05:00:25 nativespace-cdp sudo[1717514]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 05:00:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user oneoarco --user-current --json
Sep 14 05:00:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:26 nativespace-cdp sudo[1717520]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 14 05:00:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:26 nativespace-cdp sudo[1717526]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DomainInfo single_domain_data domain=pinstripe.services return_https_redirect_status=1 --output=json
Sep 14 05:00:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:29 nativespace-cdp sudo[1717540]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=oneoarco DirectoryPrivacy is_directory_protected dir=/home/oneoarco/public_html/pinstripe.services --output=json
Sep 14 05:00:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:00:40 nativespace-cdp sudo[1717623]: pam_unix(sudo:session): session closed for user root
Sep 14 05:00:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 14 05:00:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 05:00:43 nativespace-cdp sudo[1717684]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 05:00:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 14 05:00:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 14 05:00:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 14 05:00:43 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 05:00:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 05:00:44 nativespace-cdp sudo[1717691]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 05:00:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 14 05:00:44 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 14 05:00:44 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 14 05:00:44 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 05:00:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 05:01:03 nativespace-cdp sudo[1717702]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 05:01:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services -maxdepth 1 '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' -print -quit
Sep 14 05:01:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 05:01:09 nativespace-cdp sudo[1717921]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 05:01:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-admin '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 14 05:01:09 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 14 05:01:09 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 14 05:01:09 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 05:01:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 05:01:09 nativespace-cdp sudo[1717927]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 05:01:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/oneoarco/public_html/pinstripe.services && find /home/oneoarco/public_html/pinstripe.services/wp-content '(' '(' '(' '(' -type f ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 004 ')' -o '(' -perm 040 ')' -o '(' -perm 044 ')' -o '(' -perm 200 ')' -o '(' -perm 204 ')' -o '(' -perm 240 ')' -o '(' -perm 244 ')' -o '(' -perm 400 ')' -o '(' -perm 404 ')' -o '(' -perm 440 ')' -o '(' -perm 444 ')' -o '(' -perm 600 ')' -o '(' -perm 604 ')' -o '(' -perm 640 ')' -o '(' -perm 644 ')' ')' ')' ')' ')' -o '(' '(' '(' -type d ')' '(' -user oneoarco ')' '(' '!' '(' '(' -perm 000 ')' -o '(' -perm 001 ')' -o '(' -perm 004 ')' -o '(' -perm 005 ')' -o '(' -perm 010 ')' -o '(' -perm 011 ')' -o '(' -perm 014 ')' -o '(' -perm 015 ')' -o '(' -perm 040 ')' -o '(' -perm 041 ')' -o '(' -perm 044 ')' -o
Sep 14 05:01:09 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 045 ')' -o '(' -perm 050 ')' -o '(' -perm 051 ')' -o '(' -perm 054 ')' -o '(' -perm 055 ')' -o '(' -perm 100 ')' -o '(' -perm 101 ')' -o '(' -perm 104 ')' -o '(' -perm 105 ')' -o '(' -perm 110 ')' -o '(' -perm 111 ')' -o '(' -perm 114 ')' -o '(' -perm 115 ')' -o '(' -perm 140 ')' -o '(' -perm 141 ')' -o '(' -perm 144 ')' -o '(' -perm 145 ')' -o '(' -perm 150 ')' -o '(' -perm 151 ')' -o '(' -perm 154 ')' -o '(' -perm 155 ')' -o '(' -perm 200 ')' -o '(' -perm 201 ')' -o '(' -perm 204 ')' -o '(' -perm 205 ')' -o '(' -perm 210 ')' -o '(' -perm 211 ')' -o '(' -perm 214 ')' -o '(' -perm 215 ')' -o '(' -perm 240 ')' -o '(' -perm 241 ')' -o '(' -perm 244 ')' -o '(' -perm 245 ')' -o '(' -perm 250 ')' -o '(' -perm 251 ')' -o '(' -perm 254 ')' -o '(' -perm 255 ')' -o '(' -perm 300 ')' -o '(' -perm 301 ')' -o '(' -perm 304 ')' -o '(' -perm 305 ')' -o '(' -perm 310 ')' -o '(' -perm 311 ')' -o '(' -perm 314 ')' -o
Sep 14 05:01:09 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 315 ')' -o '(' -perm 340 ')' -o '(' -perm 341 ')' -o '(' -perm 344 ')' -o '(' -perm 345 ')' -o '(' -perm 350 ')' -o '(' -perm 351 ')' -o '(' -perm 354 ')' -o '(' -perm 355 ')' -o '(' -perm 400 ')' -o '(' -perm 401 ')' -o '(' -perm 404 ')' -o '(' -perm 405 ')' -o '(' -perm 410 ')' -o '(' -perm 411 ')' -o '(' -perm 414 ')' -o '(' -perm 415 ')' -o '(' -perm 440 ')' -o '(' -perm 441 ')' -o '(' -perm 444 ')' -o '(' -perm 445 ')' -o '(' -perm 450 ')' -o '(' -perm 451 ')' -o '(' -perm 454 ')' -o '(' -perm 455 ')' -o '(' -perm 500 ')' -o '(' -perm 501 ')' -o '(' -perm 504 ')' -o '(' -perm 505 ')' -o '(' -perm 510 ')' -o '(' -perm 511 ')' -o '(' -perm 514 ')' -o '(' -perm 515 ')' -o '(' -perm 540 ')' -o '(' -perm 541 ')' -o '(' -perm 544 ')' -o '(' -perm 545 ')' -o '(' -perm 550 ')' -o '(' -perm 551 ')' -o '(' -perm 554 ')' -o '(' -perm 555 ')' -o '(' -perm 600 ')' -o '(' -perm 601 ')' -o '(' -perm 604 ')' -o
Sep 14 05:01:09 nativespace-cdp sudo: wp-toolkit : (command continued) '(' -perm 605 ')' -o '(' -perm 610 ')' -o '(' -perm 611 ')' -o '(' -perm 614 ')' -o '(' -perm 615 ')' -o '(' -perm 640 ')' -o '(' -perm 641 ')' -o '(' -perm 644 ')' -o '(' -perm 645 ')' -o '(' -perm 650 ')' -o '(' -perm 651 ')' -o '(' -perm 654 ')' -o '(' -perm 655 ')' -o '(' -perm 700 ')' -o '(' -perm 701 ')' -o '(' -perm 704 ')' -o '(' -perm 705 ')' -o '(' -perm 710 ')' -o '(' -perm 711 ')' -o '(' -perm 714 ')' -o '(' -perm 715 ')' -o '(' -perm 740 ')' -o '(' -perm 741 ')' -o '(' -perm 744 ')' -o '(' -perm 745 ')' -o '(' -perm 750 ')' -o '(' -perm 751 ')' -o '(' -perm 754 ')' -o '(' -perm 755 ')' ')' ')' ')' ')' ')' -print -quit
Sep 14 05:01:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 05:01:09 nativespace-cdp sudo[1717933]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 05:01:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 14 05:01:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:01:12 nativespace-cdp sudo[1717984]: pam_unix(sudo:session): session closed for user root
Sep 14 05:01:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_links user=fortunaz --output=json
Sep 14 05:01:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:01:13 nativespace-cdp sudo[1717990]: pam_unix(sudo:session): session closed for user root
Sep 14 05:01:35 nativespace-cdp sshd[1718057]: Connection closed by 159.100.136.21 port 49674 [preauth]
Sep 14 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied /bin/sh -c cd /home/fortunaz/public_html && /usr/local/bin/php -d display_errors=0 -r 'echo PHP_MAJOR_VERSION.'"'"'.'"'"'.PHP_MINOR_VERSION.'"'"'.'"'"'.PHP_RELEASE_VERSION;'
Sep 14 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 14 05:02:01 nativespace-cdp sudo[1718145]: pam_unix(sudo:session): session closed for user fortunaz
Sep 14 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c selectorctl --user fortunaz --user-current --json
Sep 14 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:01 nativespace-cdp sudo[1718152]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz LangPHP php_get_vhost_versions --output=json
Sep 14 05:02:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:02 nativespace-cdp sudo[1718158]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /var/cpanel/cpnat
Sep 14 05:02:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:02 nativespace-cdp sudo[1718177]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DomainInfo single_domain_data domain=fortunazingara.com return_https_redirect_status=1 --output=json
Sep 14 05:02:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:05 nativespace-cdp sudo[1718199]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz Mime list_redirects --output=json
Sep 14 05:02:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:05 nativespace-cdp sudo[1718204]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=fortunaz DirectoryPrivacy is_directory_protected dir=/home/fortunaz/public_html --output=json
Sep 14 05:02:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:11 nativespace-cdp sudo[1718266]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c uapi --user=ulsukarm WpToolkitNotification send_admin_auto_updates_notification 'available_updates_text=<br/><br/>Updates are available for the following items:<br/><br/>' 'available_updates_list=1. Plugin "Popup Maker" on ONE | OAR (https://oneoar.co.uk). Installed version: 1.17.1. Available version: 1.20.0.<br/><br/>2. Plugin "Popup Maker" on Pinstripe Inventories (https://pinstripe.services). Installed version: 1.18.2. Available version: 1.20.0.<br/><br/>' installed_updates_text= installed_updates_list= 'failure_updates_text=Updates were not installed for the following items:<br/><br/>' 'failure_updates_list=1. Website "/home/bwppodcast/public_html" (http://bakewithpassion.com): Failed to reset cache for the instance #12: Error: This does not seem to be a WordPress installation.#012The used path is: /home/bwppodcast/public_html/#012Pass
Sep 14 05:02:21 nativespace-cdp sudo: wp-toolkit : (command continued) --path=`path/to/wordpress` or run `wp core download`.#012[error]FailedToExecuteWpCliCommand: exit status 1[/error]#012<br/><br/>' --output=json
Sep 14 05:02:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:21 nativespace-cdp sudo[1718451]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c httpd -v
Sep 14 05:02:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:30 nativespace-cdp sudo[1718589]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718593]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718596]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718599]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/onlycont/apexred.com/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718602]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718605]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/onlycont/apexred.com/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718608]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718611]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718614]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718617]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718620]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718624]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718627]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718630]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718633]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718636]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718639]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718642]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718645]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718648]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718651]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718655]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718658]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:31 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:31 nativespace-cdp sudo[1718662]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:31 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718665]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718668]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718671]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718674]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718677]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718680]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718683]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718686]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718689]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718692]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718695]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718698]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718701]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718704]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718707]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718710]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718713]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718716]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718719]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718722]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718725]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718728]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718731]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718734]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718737]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718740]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718743]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718746]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718749]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718752]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718756]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718759]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718762]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:32 nativespace-cdp sudo[1718765]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718768]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718771]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718774]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718778]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718781]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718784]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718787]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718790]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718793]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718796]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718799]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718802]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718805]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718808]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718811]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718814]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718817]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718820]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718823]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718826]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718829]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718832]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718835]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718838]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718841]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718844]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718847]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718850]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718853]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718857]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718860]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718863]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:33 nativespace-cdp sudo[1718866]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718869]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718872]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718875]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718879]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718882]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718885]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718888]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718891]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718894]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718897]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718900]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718903]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718907]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718910]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718913]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718916]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718919]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/lkpier/limekilnspier.org.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718922]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718925]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718928]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718932]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718935]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718938]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesdurham.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718941]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718944]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718947]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718950]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718953]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718957]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriesnorthumberland.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718960]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718963]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:34 nativespace-cdp sudo[1718966]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718969]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718972]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718975]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/inventoriessunderland.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718978]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718981]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718984]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718987]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718991]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718994]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/iphone-news.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1718997]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719000]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719003]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719006]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719009]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719012]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719016]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719019]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719023]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719026]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719029]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719032]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.co.uk/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719035]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719038]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719041]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719044]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719047]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719050]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719053]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719056]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719059]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719062]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719065]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719068]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-inventories.info/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719071]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719075]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719078]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719081]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:35 nativespace-cdp sudo[1719084]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719087]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.com/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719090]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719093]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719096]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719099]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719102]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719105]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe-services.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719108]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719111]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719114]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719117]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719120]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719123]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719126]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719129]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719132]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719135]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719138]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719141]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripe.services.oneoar.co.uk/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719144]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719147]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719150]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719153]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719157]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719160]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.com/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719163]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719166]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719169]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719172]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719175]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719178]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripeinventories.info/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719182]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719186]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719189]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:36 nativespace-cdp sudo[1719192]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719195]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719198]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719201]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719204]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719207]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719210]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719213]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719216]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719219]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719222]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719225]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719228]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719231]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719235]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/pinstripepropertyservices.info/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719238]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719241]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/ssl/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719244]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719247]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/apache2/conf.d/userdata/std/2_4/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719250]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719253]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/oneoarco/tdsnews.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719256]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719259]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719262]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719265]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.co.uk/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719268]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/ssl/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719271]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/apache2/conf.d/userdata/std/2_4/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719274]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719277]: pam_unix(sudo:session): session closed for user root
Sep 14 05:02:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/nginx/conf.d/users/fortunaz/fortunazingara.com/wp-toolkit.conf
Sep 14 05:02:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:02:37 nativespace-cdp sudo[1719280]: pam_unix(sudo:session): session closed for user root
Sep 14 05:06:35 nativespace-cdp sshd[1720303]: Connection closed by 159.100.136.21 port 59390 [preauth]
Sep 14 05:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 05:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:12 nativespace-cdp sudo[1720732]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 05:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:12 nativespace-cdp sudo[1720735]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 05:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:12 nativespace-cdp sudo[1720738]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 05:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:12 nativespace-cdp sudo[1720742]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 05:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:14 nativespace-cdp sudo[1720745]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 05:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:14 nativespace-cdp sudo[1720754]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 05:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:14 nativespace-cdp sudo[1720757]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 05:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:14 nativespace-cdp sudo[1720760]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 05:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:14 nativespace-cdp sudo[1720763]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 05:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:14 nativespace-cdp sudo[1720766]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 05:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:14 nativespace-cdp sudo[1720769]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 05:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:17 nativespace-cdp sudo[1720782]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 05:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:17 nativespace-cdp sudo[1720791]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=smrszyqg user-2=isleofwi user-3=hidden user-4=nomistakes user-5=barbersh user-6=tigerlet user-7=putterfc user-8=nscdp user-9=health2045 user-10=fortunaz user-11=leftie user-12=foods user-13=lkpier user-14=ctedorgu user-15=philmcph user-16=donnychicago user-17=firstre5 user-18=steakbridieme user-19=hirefootballgame user-20=eugincou user-21=courseme user-22=cambria1 user-23=cathski user-24=ninejimm user-25=reliable user-26=howardon user-27=pugwash user-28=paulmca1 user-29=cwsocial user-30=bwppodcast user-31=zebrapho user-32=steve user-33=sibtoncc user-34=asandcoc user-35=beauty user-36=eatspam user-37=darkstar user-38=dhyana user-39=burydropin user-40=fawcettd user-41=nsceres user-42=bakery user-43=sosevalu user-44=crrtipdl user-45=nove user-46=boldover user-47=ladburyp user-48=dancinggardener
Sep 14 05:09:17 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=stagingerris user-50=kategilpin user-51=design user-52=tstardom user-53=oubpgvbx user-54=what user-55=sketchy user-56=cath user-57=havantho user-58=nvihkvu user-59=chrisdal user-60=mcdermos user-61=careers user-62=nbhavers user-63=david user-64=tomandle user-65=jennimil user-66=ranxterc user-67=hodgsonmail user-68=outdoorc user-69=branko user-70=romaldki user-71=attlebor user-72=lucy user-73=onlycont user-74=wilsonsw user-75=musorguk user-76=megacards user-77=brmrjxl user-78=lakesan1 user-79=strathar user-80=sarafoundation user-81=atestord user-82=lbhyisi user-83=hhdugcor user-84=magichat user-85=martsblo user-86=dickemery123 user-87=ptkxhsbt user-88=ulsukarm user-89=booff user-90=foundation user-91=markward user-92=connect9 user-93=athenare user-94=vantagep user-95=maflemin user-96=lbscrmod user-97=still user-98=agproduc user-99=stephani user-100=leereyn1 user-101=jarvisin user-102=spectrum
Sep 14 05:09:17 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=hodgesonweb user-104=theblack user-105=bedfords user-106=belle user-107=ggaaorgu user-108=newstoda user-109=bemadonn user-110=brighto1 user-111=nstriton user-112=firstre2 user-113=vivienn1 user-114=battlere user-115=oneoarco user-116=innovat1 user-117=stuartge user-118=askhform user-119=nativene user-120=skyfirec user-121=alexadmin user-122=clarkass user-123=firstrel user-124=costestimatorco user-125=firstred user-126=southlon user-127=highlegh user-128=seftvta user-129=jonhartl user-130=ultbcrra user-131=firstres user-132=coursemc user-133=opaiscyx user-134=accooper user-135=ianrayne user-136=connectedshoppin user-137=thqkgnbz user-138=milloyco user-139=gilpin user-140=elecleis user-141=putterfi user-142=hubmaster user-143=carsinyo user-144=fetch feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 05:09:17 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 05:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:18 nativespace-cdp sudo[1720807]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 05:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:18 nativespace-cdp sudo[1720857]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-BT8RWHTxZGdNekTA.~
Sep 14 05:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:18 nativespace-cdp sudo[1720860]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-BT8RWHTxZGdNekTA.~'
Sep 14 05:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:18 nativespace-cdp sudo[1720863]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-BT8RWHTxZGdNekTA.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 05:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:18 nativespace-cdp sudo[1720867]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 05:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:18 nativespace-cdp sudo[1720870]: pam_unix(sudo:session): session closed for user root
Sep 14 05:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 05:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 05:09:20 nativespace-cdp sudo[1720913]: pam_unix(sudo:session): session closed for user root
Sep 14 05:11:33 nativespace-cdp sshd[1721598]: Connection closed by 159.100.136.21 port 39644 [preauth]
Sep 14 05:16:35 nativespace-cdp sshd[1723325]: Connection closed by 159.100.136.21 port 48874 [preauth]
Sep 14 05:21:26 nativespace-cdp sshd[1724456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.216.114  user=root
Sep 14 05:21:26 nativespace-cdp sshd[1724456]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 05:21:29 nativespace-cdp sshd[1724456]: Failed password for root from 209.38.216.114 port 49646 ssh2
Sep 14 05:21:29 nativespace-cdp sshd[1724456]: Received disconnect from 209.38.216.114 port 49646:11: Bye Bye [preauth]
Sep 14 05:21:29 nativespace-cdp sshd[1724456]: Disconnected from 209.38.216.114 port 49646 [preauth]
Sep 14 05:21:36 nativespace-cdp sshd[1724492]: Connection closed by 159.100.136.21 port 58026 [preauth]
Sep 14 05:23:52 nativespace-cdp sshd[1724870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=166.62.94.122  user=root
Sep 14 05:23:52 nativespace-cdp sshd[1724870]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 05:23:53 nativespace-cdp sshd[1724870]: Failed password for root from 166.62.94.122 port 41728 ssh2
Sep 14 05:23:53 nativespace-cdp sshd[1724870]: Received disconnect from 166.62.94.122 port 41728:11: Bye Bye [preauth]
Sep 14 05:23:53 nativespace-cdp sshd[1724870]: Disconnected from 166.62.94.122 port 41728 [preauth]
Sep 14 05:26:33 nativespace-cdp sshd[1725584]: Connection closed by 159.100.136.21 port 39360 [preauth]
Sep 14 05:27:07 nativespace-cdp sshd[1725734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=166.62.94.122  user=root
Sep 14 05:27:07 nativespace-cdp sshd[1725734]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 05:27:09 nativespace-cdp sshd[1725734]: Failed password for root from 166.62.94.122 port 42780 ssh2
Sep 14 05:27:09 nativespace-cdp sshd[1725734]: Received disconnect from 166.62.94.122 port 42780:11: Bye Bye [preauth]
Sep 14 05:27:09 nativespace-cdp sshd[1725734]: Disconnected from 166.62.94.122 port 42780 [preauth]
Sep 14 05:27:25 nativespace-cdp sshd[1725779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.216.114  user=root
Sep 14 05:27:25 nativespace-cdp sshd[1725779]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 05:27:28 nativespace-cdp sshd[1725779]: Failed password for root from 209.38.216.114 port 45784 ssh2
Sep 14 05:27:28 nativespace-cdp sshd[1725779]: Received disconnect from 209.38.216.114 port 45784:11: Bye Bye [preauth]
Sep 14 05:27:28 nativespace-cdp sshd[1725779]: Disconnected from 209.38.216.114 port 45784 [preauth]
Sep 14 05:27:55 nativespace-cdp sshd[1725865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=166.62.94.122  user=root
Sep 14 05:27:55 nativespace-cdp sshd[1725865]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 05:27:58 nativespace-cdp sshd[1725865]: Failed password for root from 166.62.94.122 port 56564 ssh2
Sep 14 05:27:58 nativespace-cdp sshd[1725865]: Received disconnect from 166.62.94.122 port 56564:11: Bye Bye [preauth]
Sep 14 05:27:58 nativespace-cdp sshd[1725865]: Disconnected from 166.62.94.122 port 56564 [preauth]
Sep 14 05:28:05 nativespace-cdp sshd[1725911]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.216.114  user=root
Sep 14 05:28:05 nativespace-cdp sshd[1725911]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 05:28:07 nativespace-cdp sshd[1725911]: Failed password for root from 209.38.216.114 port 60362 ssh2
Sep 14 05:28:07 nativespace-cdp sshd[1725911]: Received disconnect from 209.38.216.114 port 60362:11: Bye Bye [preauth]
Sep 14 05:28:07 nativespace-cdp sshd[1725911]: Disconnected from 209.38.216.114 port 60362 [preauth]
Sep 14 05:31:35 nativespace-cdp sshd[1727370]: Connection closed by 159.100.136.21 port 48502 [preauth]
Sep 14 05:35:09 nativespace-cdp su: pam_unix(su:session): session opened for user agproduc by (uid=0)
Sep 14 05:35:09 nativespace-cdp su[1728230]: pam_unix(su:session): session closed for user agproduc
Sep 14 05:36:33 nativespace-cdp sshd[1728535]: Connection closed by 159.100.136.21 port 57996 [preauth]
Sep 14 05:41:36 nativespace-cdp sshd[1729758]: Connection closed by 159.100.136.21 port 38944 [preauth]
Sep 14 05:46:33 nativespace-cdp sshd[1731321]: Connection closed by 159.100.136.21 port 48658 [preauth]
Sep 14 05:51:33 nativespace-cdp sshd[1732433]: Connection closed by 159.100.136.21 port 57938 [preauth]
Sep 14 06:01:36 nativespace-cdp sshd[1735202]: Connection closed by 159.100.136.21 port 47212 [preauth]
Sep 14 06:06:33 nativespace-cdp sshd[1736355]: Connection closed by 159.100.136.21 port 56918 [preauth]
Sep 14 06:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 06:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:33 nativespace-cdp sudo[1736941]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 06:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:33 nativespace-cdp sudo[1736954]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 06:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:35 nativespace-cdp sudo[1736957]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 06:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:36 nativespace-cdp sudo[1736972]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 06:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:39 nativespace-cdp sudo[1736978]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 06:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:39 nativespace-cdp sudo[1736995]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 06:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:40 nativespace-cdp sudo[1737000]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 06:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:40 nativespace-cdp sudo[1737004]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 06:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:40 nativespace-cdp sudo[1737009]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 06:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:40 nativespace-cdp sudo[1737015]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 06:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:40 nativespace-cdp sudo[1737020]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 06:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:42 nativespace-cdp sudo[1737035]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 06:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:42 nativespace-cdp sudo[1737041]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=wilsonsw user-2=megacards user-3=musorguk user-4=brmrjxl user-5=lakesan1 user-6=strathar user-7=atestord user-8=sarafoundation user-9=hhdugcor user-10=lbhyisi user-11=magichat user-12=martsblo user-13=dickemery123 user-14=ptkxhsbt user-15=ulsukarm user-16=booff user-17=markward user-18=foundation user-19=vantagep user-20=connect9 user-21=athenare user-22=lbscrmod user-23=maflemin user-24=agproduc user-25=still user-26=stephani user-27=leereyn1 user-28=jarvisin user-29=spectrum user-30=hodgesonweb user-31=theblack user-32=bedfords user-33=newstoda user-34=ggaaorgu user-35=belle user-36=bemadonn user-37=nstriton user-38=brighto1 user-39=vivienn1 user-40=firstre2 user-41=oneoarco user-42=battlere user-43=innovat1 user-44=stuartge user-45=askhform user-46=nativene user-47=skyfirec user-48=alexadmin
Sep 14 06:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstrel user-50=clarkass user-51=costestimatorco user-52=firstred user-53=highlegh user-54=southlon user-55=ultbcrra user-56=jonhartl user-57=seftvta user-58=firstres user-59=coursemc user-60=opaiscyx user-61=accooper user-62=ianrayne user-63=connectedshoppin user-64=thqkgnbz user-65=milloyco user-66=gilpin user-67=elecleis user-68=putterfi user-69=hubmaster user-70=fetch user-71=carsinyo user-72=isleofwi user-73=smrszyqg user-74=nomistakes user-75=hidden user-76=tigerlet user-77=barbersh user-78=nscdp user-79=putterfc user-80=leftie user-81=foods user-82=fortunaz user-83=health2045 user-84=lkpier user-85=donnychicago user-86=firstre5 user-87=steakbridieme user-88=ctedorgu user-89=philmcph user-90=hirefootballgame user-91=eugincou user-92=courseme user-93=cambria1 user-94=cathski user-95=reliable user-96=ninejimm user-97=cwsocial user-98=pugwash user-99=howardon user-100=paulmca1 user-101=bwppodcast
Sep 14 06:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=zebrapho user-103=steve user-104=sibtoncc user-105=asandcoc user-106=beauty user-107=darkstar user-108=eatspam user-109=dhyana user-110=fawcettd user-111=burydropin user-112=nsceres user-113=bakery user-114=crrtipdl user-115=sosevalu user-116=nove user-117=boldover user-118=dancinggardener user-119=stagingerris user-120=ladburyp user-121=kategilpin user-122=design user-123=tstardom user-124=oubpgvbx user-125=what user-126=havantho user-127=cath user-128=sketchy user-129=nvihkvu user-130=chrisdal user-131=mcdermos user-132=david user-133=careers user-134=nbhavers user-135=tomandle user-136=jennimil user-137=ranxterc user-138=outdoorc user-139=hodgsonmail user-140=branko user-141=romaldki user-142=lucy user-143=attlebor user-144=onlycont feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 06:09:42 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 06:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:44 nativespace-cdp sudo[1737047]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 06:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:44 nativespace-cdp sudo[1737098]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qZUNw9QmzJ8S74rK.~
Sep 14 06:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:45 nativespace-cdp sudo[1737106]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qZUNw9QmzJ8S74rK.~'
Sep 14 06:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:45 nativespace-cdp sudo[1737113]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-qZUNw9QmzJ8S74rK.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 06:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:45 nativespace-cdp sudo[1737121]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 06:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:45 nativespace-cdp sudo[1737126]: pam_unix(sudo:session): session closed for user root
Sep 14 06:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 06:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 06:09:51 nativespace-cdp sudo[1737201]: pam_unix(sudo:session): session closed for user root
Sep 14 06:11:33 nativespace-cdp sshd[1737694]: Connection closed by 159.100.136.21 port 38384 [preauth]
Sep 14 06:16:33 nativespace-cdp sshd[1739387]: Connection closed by 159.100.136.21 port 48038 [preauth]
Sep 14 06:20:24 nativespace-cdp sshd[1740328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.255.3.213  user=root
Sep 14 06:20:24 nativespace-cdp sshd[1740328]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 06:20:26 nativespace-cdp sshd[1740328]: Failed password for root from 85.255.3.213 port 54706 ssh2
Sep 14 06:20:26 nativespace-cdp sshd[1740328]: Received disconnect from 85.255.3.213 port 54706:11: Bye Bye [preauth]
Sep 14 06:20:26 nativespace-cdp sshd[1740328]: Disconnected from 85.255.3.213 port 54706 [preauth]
Sep 14 06:21:33 nativespace-cdp sshd[1740620]: Connection closed by 159.100.136.21 port 57452 [preauth]
Sep 14 06:28:04 nativespace-cdp sshd[1742562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.255.3.213  user=root
Sep 14 06:28:04 nativespace-cdp sshd[1742562]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 06:28:06 nativespace-cdp sshd[1742562]: Failed password for root from 85.255.3.213 port 56982 ssh2
Sep 14 06:28:06 nativespace-cdp sshd[1742562]: Received disconnect from 85.255.3.213 port 56982:11: Bye Bye [preauth]
Sep 14 06:28:06 nativespace-cdp sshd[1742562]: Disconnected from 85.255.3.213 port 56982 [preauth]
Sep 14 06:28:54 nativespace-cdp sshd[1742703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.255.3.213  user=root
Sep 14 06:28:54 nativespace-cdp sshd[1742703]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 06:28:56 nativespace-cdp sshd[1742703]: Failed password for root from 85.255.3.213 port 34582 ssh2
Sep 14 06:31:33 nativespace-cdp sshd[1743561]: Connection closed by 159.100.136.21 port 46214 [preauth]
Sep 14 06:36:33 nativespace-cdp sshd[1744764]: Connection closed by 159.100.136.21 port 55576 [preauth]
Sep 14 06:41:33 nativespace-cdp sshd[1745822]: Connection closed by 159.100.136.21 port 36500 [preauth]
Sep 14 06:46:34 nativespace-cdp sshd[1747174]: Connection closed by 159.100.136.21 port 45670 [preauth]
Sep 14 06:51:33 nativespace-cdp sshd[1748423]: Connection closed by 159.100.136.21 port 55292 [preauth]
Sep 14 06:56:33 nativespace-cdp sshd[1749439]: Connection closed by 159.100.136.21 port 36506 [preauth]
Sep 14 07:01:33 nativespace-cdp sshd[1751218]: Connection closed by 159.100.136.21 port 45604 [preauth]
Sep 14 07:06:33 nativespace-cdp sshd[1752418]: Connection closed by 159.100.136.21 port 55412 [preauth]
Sep 14 07:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 07:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:09 nativespace-cdp sudo[1752887]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 07:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:09 nativespace-cdp sudo[1752891]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 07:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:10 nativespace-cdp sudo[1752896]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 07:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:10 nativespace-cdp sudo[1752905]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 07:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:13 nativespace-cdp sudo[1752911]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 07:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:13 nativespace-cdp sudo[1752938]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 07:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:13 nativespace-cdp sudo[1752943]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 07:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:13 nativespace-cdp sudo[1752947]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 07:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:13 nativespace-cdp sudo[1752952]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 07:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:13 nativespace-cdp sudo[1752957]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 07:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:13 nativespace-cdp sudo[1752963]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 07:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:15 nativespace-cdp sudo[1752977]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 07:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:15 nativespace-cdp sudo[1752984]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=stuartge user-2=askhform user-3=innovat1 user-4=nativene user-5=alexadmin user-6=skyfirec user-7=bedfords user-8=bemadonn user-9=newstoda user-10=ggaaorgu user-11=belle user-12=nstriton user-13=brighto1 user-14=oneoarco user-15=battlere user-16=vivienn1 user-17=firstre2 user-18=ianrayne user-19=accooper user-20=thqkgnbz user-21=connectedshoppin user-22=elecleis user-23=gilpin user-24=milloyco user-25=fetch user-26=carsinyo user-27=hubmaster user-28=putterfi user-29=costestimatorco user-30=firstrel user-31=clarkass user-32=highlegh user-33=southlon user-34=firstred user-35=firstres user-36=ultbcrra user-37=jonhartl user-38=seftvta user-39=coursemc user-40=opaiscyx user-41=hhdugcor user-42=lbhyisi user-43=magichat user-44=martsblo user-45=ptkxhsbt user-46=dickemery123 user-47=wilsonsw
Sep 14 07:09:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=musorguk user-50=lakesan1 user-51=brmrjxl user-52=atestord user-53=sarafoundation user-54=strathar user-55=agproduc user-56=still user-57=leereyn1 user-58=stephani user-59=jarvisin user-60=hodgesonweb user-61=theblack user-62=spectrum user-63=ulsukarm user-64=foundation user-65=booff user-66=markward user-67=lbscrmod user-68=maflemin user-69=vantagep user-70=athenare user-71=connect9 user-72=kategilpin user-73=stagingerris user-74=dancinggardener user-75=ladburyp user-76=design user-77=what user-78=tstardom user-79=oubpgvbx user-80=nvihkvu user-81=havantho user-82=sketchy user-83=cath user-84=crrtipdl user-85=sosevalu user-86=bakery user-87=nove user-88=boldover user-89=branko user-90=ranxterc user-91=outdoorc user-92=hodgsonmail user-93=romaldki user-94=lucy user-95=attlebor user-96=onlycont user-97=mcdermos user-98=chrisdal user-99=david user-100=nbhavers user-101=careers
Sep 14 07:09:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=tomandle user-103=jennimil user-104=hirefootballgame user-105=courseme user-106=eugincou user-107=reliable user-108=ninejimm user-109=cathski user-110=cambria1 user-111=cwsocial user-112=howardon user-113=pugwash user-114=paulmca1 user-115=isleofwi user-116=smrszyqg user-117=tigerlet user-118=barbersh user-119=nomistakes user-120=hidden user-121=foods user-122=leftie user-123=health2045 user-124=fortunaz user-125=nscdp user-126=putterfc user-127=firstre5 user-128=steakbridieme user-129=donnychicago user-130=philmcph user-131=ctedorgu user-132=lkpier user-133=darkstar user-134=eatspam user-135=beauty user-136=dhyana user-137=fawcettd user-138=burydropin user-139=nsceres user-140=zebrapho user-141=bwppodcast user-142=steve user-143=asandcoc user-144=sibtoncc feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 14 07:09:15 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 07:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:16 nativespace-cdp sudo[1752990]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 07:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:17 nativespace-cdp sudo[1753003]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YHUN3EUAlLzxIQOS.~
Sep 14 07:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:17 nativespace-cdp sudo[1753008]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YHUN3EUAlLzxIQOS.~'
Sep 14 07:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:17 nativespace-cdp sudo[1753012]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-YHUN3EUAlLzxIQOS.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 07:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:17 nativespace-cdp sudo[1753018]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 07:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:17 nativespace-cdp sudo[1753023]: pam_unix(sudo:session): session closed for user root
Sep 14 07:09:18 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 07:09:18 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 07:09:18 nativespace-cdp sudo[1753044]: pam_unix(sudo:session): session closed for user root
Sep 14 07:11:33 nativespace-cdp sshd[1753689]: Connection closed by 159.100.136.21 port 36804 [preauth]
Sep 14 07:16:35 nativespace-cdp sshd[1755358]: Connection closed by 159.100.136.21 port 45650 [preauth]
Sep 14 07:21:34 nativespace-cdp sshd[1756538]: Connection closed by 159.100.136.21 port 54264 [preauth]
Sep 14 07:26:33 nativespace-cdp sshd[1757565]: Connection closed by 159.100.136.21 port 35056 [preauth]
Sep 14 07:31:33 nativespace-cdp sshd[1759195]: Connection closed by 159.100.136.21 port 44652 [preauth]
Sep 14 07:36:33 nativespace-cdp sshd[1760376]: Connection closed by 159.100.136.21 port 54594 [preauth]
Sep 14 07:41:33 nativespace-cdp sshd[1761476]: Connection closed by 159.100.136.21 port 35404 [preauth]
Sep 14 07:46:33 nativespace-cdp sshd[1763169]: Connection closed by 159.100.136.21 port 44652 [preauth]
Sep 14 07:51:33 nativespace-cdp sshd[1764323]: Connection closed by 159.100.136.21 port 53664 [preauth]
Sep 14 07:56:33 nativespace-cdp sshd[1765480]: Connection closed by 159.100.136.21 port 35446 [preauth]
Sep 14 08:01:36 nativespace-cdp sshd[1767212]: Connection closed by 159.100.136.21 port 45098 [preauth]
Sep 14 08:06:34 nativespace-cdp sshd[1768351]: Connection closed by 159.100.136.21 port 54972 [preauth]
Sep 14 08:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 08:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:21 nativespace-cdp sudo[1768808]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 08:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:21 nativespace-cdp sudo[1768813]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:21 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 08:09:21 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:22 nativespace-cdp sudo[1768819]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 08:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:22 nativespace-cdp sudo[1768826]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:22 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 08:09:22 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:24 nativespace-cdp sudo[1768832]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 08:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:24 nativespace-cdp sudo[1768842]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 08:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:24 nativespace-cdp sudo[1768847]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 08:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:24 nativespace-cdp sudo[1768853]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 08:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:24 nativespace-cdp sudo[1768858]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 08:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:24 nativespace-cdp sudo[1768863]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:24 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 08:09:24 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:24 nativespace-cdp sudo[1768869]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:26 nativespace-cdp sudo[1768884]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:26 nativespace-cdp sudo[1768890]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=brighto1 user-2=nstriton user-3=battlere user-4=oneoarco user-5=firstre2 user-6=vivienn1 user-7=bedfords user-8=bemadonn user-9=ggaaorgu user-10=belle user-11=newstoda user-12=alexadmin user-13=skyfirec user-14=stuartge user-15=askhform user-16=innovat1 user-17=nativene user-18=firstres user-19=seftvta user-20=jonhartl user-21=ultbcrra user-22=coursemc user-23=opaiscyx user-24=costestimatorco user-25=firstrel user-26=clarkass user-27=southlon user-28=highlegh user-29=firstred user-30=elecleis user-31=milloyco user-32=gilpin user-33=carsinyo user-34=fetch user-35=hubmaster user-36=putterfi user-37=ianrayne user-38=accooper user-39=thqkgnbz user-40=connectedshoppin user-41=lakesan1 user-42=brmrjxl user-43=sarafoundation user-44=atestord user-45=strathar user-46=wilsonsw user-47=musorguk
Sep 14 08:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=megacards user-49=martsblo user-50=ptkxhsbt user-51=dickemery123 user-52=lbhyisi user-53=hhdugcor user-54=magichat user-55=booff user-56=foundation user-57=markward user-58=maflemin user-59=lbscrmod user-60=connect9 user-61=athenare user-62=vantagep user-63=ulsukarm user-64=jarvisin user-65=hodgesonweb user-66=theblack user-67=spectrum user-68=still user-69=agproduc user-70=leereyn1 user-71=stephani user-72=nove user-73=boldover user-74=sosevalu user-75=crrtipdl user-76=bakery user-77=what user-78=oubpgvbx user-79=tstardom user-80=nvihkvu user-81=cath user-82=sketchy user-83=havantho user-84=kategilpin user-85=ladburyp user-86=stagingerris user-87=dancinggardener user-88=design user-89=tomandle user-90=jennimil user-91=mcdermos user-92=chrisdal user-93=nbhavers user-94=careers user-95=david user-96=attlebor user-97=lucy user-98=onlycont user-99=branko user-100=hodgsonmail user-101=ranxterc
Sep 14 08:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=outdoorc user-103=romaldki user-104=health2045 user-105=fortunaz user-106=leftie user-107=foods user-108=putterfc user-109=nscdp user-110=philmcph user-111=ctedorgu user-112=donnychicago user-113=steakbridieme user-114=firstre5 user-115=lkpier user-116=smrszyqg user-117=isleofwi user-118=tigerlet user-119=barbersh user-120=hidden user-121=nomistakes user-122=ninejimm user-123=reliable user-124=cathski user-125=cambria1 user-126=pugwash user-127=howardon user-128=paulmca1 user-129=cwsocial user-130=hirefootballgame user-131=courseme user-132=eugincou user-133=asandcoc user-134=sibtoncc user-135=zebrapho user-136=bwppodcast user-137=steve user-138=burydropin user-139=fawcettd user-140=nsceres user-141=eatspam user-142=darkstar user-143=beauty user-144=dhyana feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 14 08:09:26 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 08:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:27 nativespace-cdp sudo[1768897]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:28 nativespace-cdp sudo[1768904]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rEkFmSRvsMqVsJNV.~
Sep 14 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:28 nativespace-cdp sudo[1768909]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rEkFmSRvsMqVsJNV.~'
Sep 14 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:28 nativespace-cdp sudo[1768913]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-rEkFmSRvsMqVsJNV.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:28 nativespace-cdp sudo[1768920]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 08:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:28 nativespace-cdp sudo[1768925]: pam_unix(sudo:session): session closed for user root
Sep 14 08:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 08:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 08:09:29 nativespace-cdp sudo[1768948]: pam_unix(sudo:session): session closed for user root
Sep 14 08:11:33 nativespace-cdp sshd[1769635]: Connection closed by 159.100.136.21 port 36190 [preauth]
Sep 14 08:16:33 nativespace-cdp sshd[1771212]: Connection closed by 159.100.136.21 port 45918 [preauth]
Sep 14 08:21:36 nativespace-cdp sshd[1772358]: Connection closed by 159.100.136.21 port 55200 [preauth]
Sep 14 08:26:33 nativespace-cdp sshd[1773437]: Connection closed by 159.100.136.21 port 37038 [preauth]
Sep 14 08:27:52 nativespace-cdp sshd[1774040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.90.63.146  user=root
Sep 14 08:27:52 nativespace-cdp sshd[1774040]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:27:55 nativespace-cdp sshd[1774040]: Failed password for root from 102.90.63.146 port 47025 ssh2
Sep 14 08:27:55 nativespace-cdp sshd[1774040]: Received disconnect from 102.90.63.146 port 47025:11: Bye Bye [preauth]
Sep 14 08:27:55 nativespace-cdp sshd[1774040]: Disconnected from 102.90.63.146 port 47025 [preauth]
Sep 14 08:29:48 nativespace-cdp sshd[1774523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.146.239  user=root
Sep 14 08:29:48 nativespace-cdp sshd[1774523]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:29:50 nativespace-cdp sshd[1774523]: Failed password for root from 143.198.146.239 port 42736 ssh2
Sep 14 08:29:51 nativespace-cdp sshd[1774523]: Received disconnect from 143.198.146.239 port 42736:11: Bye Bye [preauth]
Sep 14 08:29:51 nativespace-cdp sshd[1774523]: Disconnected from 143.198.146.239 port 42736 [preauth]
Sep 14 08:31:33 nativespace-cdp sshd[1775195]: Connection closed by 159.100.136.21 port 45868 [preauth]
Sep 14 08:31:40 nativespace-cdp sshd[1775212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.69.153.130  user=root
Sep 14 08:31:40 nativespace-cdp sshd[1775212]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:31:42 nativespace-cdp sshd[1775212]: Failed password for root from 185.69.153.130 port 43446 ssh2
Sep 14 08:31:42 nativespace-cdp sshd[1775212]: Received disconnect from 185.69.153.130 port 43446:11: Bye Bye [preauth]
Sep 14 08:31:42 nativespace-cdp sshd[1775212]: Disconnected from 185.69.153.130 port 43446 [preauth]
Sep 14 08:32:07 nativespace-cdp sshd[1775315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.176.223.57  user=root
Sep 14 08:32:07 nativespace-cdp sshd[1775315]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:32:09 nativespace-cdp sshd[1775315]: Failed password for root from 181.176.223.57 port 57220 ssh2
Sep 14 08:32:09 nativespace-cdp sshd[1775315]: Received disconnect from 181.176.223.57 port 57220:11: Bye Bye [preauth]
Sep 14 08:32:09 nativespace-cdp sshd[1775315]: Disconnected from 181.176.223.57 port 57220 [preauth]
Sep 14 08:35:13 nativespace-cdp sshd[1775922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.90.63.146  user=root
Sep 14 08:35:13 nativespace-cdp sshd[1775922]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:35:15 nativespace-cdp sshd[1775922]: Failed password for root from 102.90.63.146 port 35380 ssh2
Sep 14 08:35:15 nativespace-cdp sshd[1775922]: Received disconnect from 102.90.63.146 port 35380:11: Bye Bye [preauth]
Sep 14 08:35:15 nativespace-cdp sshd[1775922]: Disconnected from 102.90.63.146 port 35380 [preauth]
Sep 14 08:35:38 nativespace-cdp sshd[1776053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.146.239  user=root
Sep 14 08:35:38 nativespace-cdp sshd[1776053]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:35:40 nativespace-cdp sshd[1776053]: Failed password for root from 143.198.146.239 port 36486 ssh2
Sep 14 08:35:44 nativespace-cdp sshd[1776053]: Received disconnect from 143.198.146.239 port 36486:11: Bye Bye [preauth]
Sep 14 08:35:44 nativespace-cdp sshd[1776053]: Disconnected from 143.198.146.239 port 36486 [preauth]
Sep 14 08:35:47 nativespace-cdp sshd[1776082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.69.153.130  user=root
Sep 14 08:35:47 nativespace-cdp sshd[1776082]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:35:49 nativespace-cdp sshd[1776082]: Failed password for root from 185.69.153.130 port 60092 ssh2
Sep 14 08:35:49 nativespace-cdp sshd[1776082]: Received disconnect from 185.69.153.130 port 60092:11: Bye Bye [preauth]
Sep 14 08:35:49 nativespace-cdp sshd[1776082]: Disconnected from 185.69.153.130 port 60092 [preauth]
Sep 14 08:35:58 nativespace-cdp sshd[1776103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.176.223.57  user=root
Sep 14 08:35:58 nativespace-cdp sshd[1776103]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:36:00 nativespace-cdp sshd[1776109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.90.63.146  user=root
Sep 14 08:36:00 nativespace-cdp sshd[1776109]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:36:00 nativespace-cdp sshd[1776103]: Failed password for root from 181.176.223.57 port 59940 ssh2
Sep 14 08:36:02 nativespace-cdp sshd[1776109]: Failed password for root from 102.90.63.146 port 13045 ssh2
Sep 14 08:36:04 nativespace-cdp sshd[1776103]: Received disconnect from 181.176.223.57 port 59940:11: Bye Bye [preauth]
Sep 14 08:36:04 nativespace-cdp sshd[1776103]: Disconnected from 181.176.223.57 port 59940 [preauth]
Sep 14 08:36:08 nativespace-cdp sshd[1776109]: Received disconnect from 102.90.63.146 port 13045:11: Bye Bye [preauth]
Sep 14 08:36:08 nativespace-cdp sshd[1776109]: Disconnected from 102.90.63.146 port 13045 [preauth]
Sep 14 08:36:20 nativespace-cdp sshd[1776287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.146.239  user=root
Sep 14 08:36:20 nativespace-cdp sshd[1776287]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:36:22 nativespace-cdp sshd[1776287]: Failed password for root from 143.198.146.239 port 49590 ssh2
Sep 14 08:36:35 nativespace-cdp sshd[1776348]: Connection closed by 159.100.136.21 port 55524 [preauth]
Sep 14 08:36:36 nativespace-cdp sshd[1776351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.69.153.130  user=root
Sep 14 08:36:36 nativespace-cdp sshd[1776351]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:36:38 nativespace-cdp sshd[1776351]: Failed password for root from 185.69.153.130 port 50730 ssh2
Sep 14 08:36:38 nativespace-cdp sshd[1776351]: Received disconnect from 185.69.153.130 port 50730:11: Bye Bye [preauth]
Sep 14 08:36:38 nativespace-cdp sshd[1776351]: Disconnected from 185.69.153.130 port 50730 [preauth]
Sep 14 08:36:53 nativespace-cdp sshd[1776414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.176.223.57  user=root
Sep 14 08:36:53 nativespace-cdp sshd[1776414]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 08:36:55 nativespace-cdp sshd[1776414]: Failed password for root from 181.176.223.57 port 59226 ssh2
Sep 14 08:36:59 nativespace-cdp sshd[1776414]: Received disconnect from 181.176.223.57 port 59226:11: Bye Bye [preauth]
Sep 14 08:36:59 nativespace-cdp sshd[1776414]: Disconnected from 181.176.223.57 port 59226 [preauth]
Sep 14 08:41:36 nativespace-cdp sshd[1777536]: Connection closed by 159.100.136.21 port 36478 [preauth]
Sep 14 08:46:36 nativespace-cdp sshd[1779171]: Connection closed by 159.100.136.21 port 45498 [preauth]
Sep 14 08:47:04 nativespace-cdp sshd[1779271]: Bad protocol version identification '\003' from 91.238.181.31 port 65365
Sep 14 08:51:33 nativespace-cdp sshd[1781056]: Connection closed by 159.100.136.21 port 55218 [preauth]
Sep 14 08:56:34 nativespace-cdp sshd[1782332]: Connection closed by 159.100.136.21 port 36106 [preauth]
Sep 14 09:01:36 nativespace-cdp sshd[1784172]: Connection closed by 159.100.136.21 port 44530 [preauth]
Sep 14 09:06:34 nativespace-cdp sshd[1785466]: Connection closed by 159.100.136.21 port 53996 [preauth]
Sep 14 09:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 09:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:33 nativespace-cdp sudo[1786228]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 09:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:33 nativespace-cdp sudo[1786236]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 09:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:38 nativespace-cdp sudo[1786239]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 09:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:38 nativespace-cdp sudo[1786249]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 09:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:42 nativespace-cdp sudo[1786255]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 09:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:42 nativespace-cdp sudo[1786281]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 09:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:42 nativespace-cdp sudo[1786287]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 09:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:42 nativespace-cdp sudo[1786292]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 09:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:42 nativespace-cdp sudo[1786297]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 09:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:42 nativespace-cdp sudo[1786303]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 09:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:42 nativespace-cdp sudo[1786308]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 09:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:44 nativespace-cdp sudo[1786329]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 09:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:45 nativespace-cdp sudo[1786336]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:45 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=tomandle user-2=jennimil user-3=chrisdal user-4=mcdermos user-5=david user-6=nbhavers user-7=careers user-8=lucy user-9=attlebor user-10=onlycont user-11=outdoorc user-12=ranxterc user-13=hodgsonmail user-14=branko user-15=romaldki user-16=nove user-17=boldover user-18=bakery user-19=crrtipdl user-20=sosevalu user-21=oubpgvbx user-22=tstardom user-23=what user-24=havantho user-25=cath user-26=sketchy user-27=nvihkvu user-28=dancinggardener user-29=stagingerris user-30=ladburyp user-31=kategilpin user-32=design user-33=asandcoc user-34=sibtoncc user-35=bwppodcast user-36=zebrapho user-37=steve user-38=fawcettd user-39=burydropin user-40=nsceres user-41=beauty user-42=darkstar user-43=eatspam user-44=dhyana user-45=nscdp user-46=putterfc user-47=foods user-48=leftie user-49=health2045
Sep 14 09:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=fortunaz user-51=lkpier user-52=donnychicago user-53=steakbridieme user-54=firstre5 user-55=philmcph user-56=ctedorgu user-57=isleofwi user-58=smrszyqg user-59=nomistakes user-60=hidden user-61=tigerlet user-62=barbersh user-63=cambria1 user-64=cathski user-65=ninejimm user-66=reliable user-67=cwsocial user-68=howardon user-69=pugwash user-70=paulmca1 user-71=hirefootballgame user-72=eugincou user-73=courseme user-74=ultbcrra user-75=jonhartl user-76=seftvta user-77=firstres user-78=opaiscyx user-79=coursemc user-80=clarkass user-81=firstrel user-82=costestimatorco user-83=firstred user-84=highlegh user-85=southlon user-86=milloyco user-87=gilpin user-88=elecleis user-89=putterfi user-90=hubmaster user-91=fetch user-92=carsinyo user-93=accooper user-94=ianrayne user-95=connectedshoppin user-96=thqkgnbz user-97=nstriton user-98=brighto1 user-99=vivienn1 user-100=firstre2 user-101=oneoarco user-102=battlere
Sep 14 09:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=bedfords user-104=newstoda user-105=belle user-106=ggaaorgu user-107=bemadonn user-108=skyfirec user-109=alexadmin user-110=innovat1 user-111=stuartge user-112=askhform user-113=nativene user-114=markward user-115=booff user-116=foundation user-117=vantagep user-118=athenare user-119=connect9 user-120=lbscrmod user-121=maflemin user-122=ulsukarm user-123=jarvisin user-124=spectrum user-125=theblack user-126=hodgesonweb user-127=agproduc user-128=still user-129=stephani user-130=leereyn1 user-131=lakesan1 user-132=brmrjxl user-133=strathar user-134=atestord user-135=sarafoundation user-136=wilsonsw user-137=megacards user-138=musorguk user-139=martsblo user-140=dickemery123 user-141=ptkxhsbt user-142=hhdugcor user-143=lbhyisi user-144=magichat feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 09:09:45 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 09:09:45 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:46 nativespace-cdp sudo[1786344]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 09:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:47 nativespace-cdp sudo[1786352]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-16O21RxGLm3nN8MA.~
Sep 14 09:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:47 nativespace-cdp sudo[1786357]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-16O21RxGLm3nN8MA.~'
Sep 14 09:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:47 nativespace-cdp sudo[1786361]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-16O21RxGLm3nN8MA.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 09:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:47 nativespace-cdp sudo[1786367]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 09:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:47 nativespace-cdp sudo[1786372]: pam_unix(sudo:session): session closed for user root
Sep 14 09:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 09:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 09:09:49 nativespace-cdp sudo[1786396]: pam_unix(sudo:session): session closed for user root
Sep 14 09:11:33 nativespace-cdp sshd[1786950]: Connection closed by 159.100.136.21 port 34878 [preauth]
Sep 14 09:15:33 nativespace-cdp sshd[1788433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.101.225  user=root
Sep 14 09:15:33 nativespace-cdp sshd[1788433]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:15:36 nativespace-cdp sshd[1788433]: Failed password for root from 51.210.101.225 port 53724 ssh2
Sep 14 09:15:36 nativespace-cdp sshd[1788433]: Received disconnect from 51.210.101.225 port 53724:11: Bye Bye [preauth]
Sep 14 09:15:36 nativespace-cdp sshd[1788433]: Disconnected from 51.210.101.225 port 53724 [preauth]
Sep 14 09:16:33 nativespace-cdp sshd[1788744]: Connection closed by 159.100.136.21 port 44524 [preauth]
Sep 14 09:20:18 nativespace-cdp sshd[1789735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.86.100.138  user=root
Sep 14 09:20:18 nativespace-cdp sshd[1789735]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:20:19 nativespace-cdp sshd[1789735]: Failed password for root from 167.86.100.138 port 34616 ssh2
Sep 14 09:20:19 nativespace-cdp sshd[1789735]: Received disconnect from 167.86.100.138 port 34616:11: Bye Bye [preauth]
Sep 14 09:20:19 nativespace-cdp sshd[1789735]: Disconnected from 167.86.100.138 port 34616 [preauth]
Sep 14 09:21:21 nativespace-cdp sshd[1790092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.101.225  user=root
Sep 14 09:21:21 nativespace-cdp sshd[1790092]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:21:22 nativespace-cdp sshd[1790092]: Failed password for root from 51.210.101.225 port 36120 ssh2
Sep 14 09:21:22 nativespace-cdp sshd[1790092]: Received disconnect from 51.210.101.225 port 36120:11: Bye Bye [preauth]
Sep 14 09:21:22 nativespace-cdp sshd[1790092]: Disconnected from 51.210.101.225 port 36120 [preauth]
Sep 14 09:21:26 nativespace-cdp sshd[1790102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.86.100.138  user=root
Sep 14 09:21:26 nativespace-cdp sshd[1790102]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:21:28 nativespace-cdp sshd[1790102]: Failed password for root from 167.86.100.138 port 40112 ssh2
Sep 14 09:21:35 nativespace-cdp sshd[1790122]: Connection closed by 159.100.136.21 port 53458 [preauth]
Sep 14 09:21:36 nativespace-cdp sshd[1790102]: Received disconnect from 167.86.100.138 port 40112:11: Bye Bye [preauth]
Sep 14 09:21:36 nativespace-cdp sshd[1790102]: Disconnected from 167.86.100.138 port 40112 [preauth]
Sep 14 09:22:02 nativespace-cdp sshd[1790211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.101.225  user=root
Sep 14 09:22:02 nativespace-cdp sshd[1790211]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:22:04 nativespace-cdp sshd[1790211]: Failed password for root from 51.210.101.225 port 55312 ssh2
Sep 14 09:22:04 nativespace-cdp sshd[1790211]: Received disconnect from 51.210.101.225 port 55312:11: Bye Bye [preauth]
Sep 14 09:22:04 nativespace-cdp sshd[1790211]: Disconnected from 51.210.101.225 port 55312 [preauth]
Sep 14 09:22:07 nativespace-cdp sshd[1790252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.86.100.138  user=root
Sep 14 09:22:07 nativespace-cdp sshd[1790252]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:22:09 nativespace-cdp sshd[1790252]: Failed password for root from 167.86.100.138 port 40906 ssh2
Sep 14 09:26:36 nativespace-cdp sshd[1791347]: Connection closed by 159.100.136.21 port 35110 [preauth]
Sep 14 09:28:11 nativespace-cdp sshd[1792179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.71.21.1  user=root
Sep 14 09:28:11 nativespace-cdp sshd[1792179]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:28:14 nativespace-cdp sshd[1792179]: Failed password for root from 201.71.21.1 port 41516 ssh2
Sep 14 09:28:18 nativespace-cdp sshd[1792179]: Received disconnect from 201.71.21.1 port 41516:11: Bye Bye [preauth]
Sep 14 09:28:18 nativespace-cdp sshd[1792179]: Disconnected from 201.71.21.1 port 41516 [preauth]
Sep 14 09:29:03 nativespace-cdp sshd[1792314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.144.66  user=root
Sep 14 09:29:03 nativespace-cdp sshd[1792314]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:29:05 nativespace-cdp sshd[1792314]: Failed password for root from 36.93.144.66 port 53624 ssh2
Sep 14 09:29:05 nativespace-cdp sshd[1792314]: Received disconnect from 36.93.144.66 port 53624:11: Bye Bye [preauth]
Sep 14 09:29:05 nativespace-cdp sshd[1792314]: Disconnected from 36.93.144.66 port 53624 [preauth]
Sep 14 09:31:33 nativespace-cdp sshd[1793141]: Connection closed by 159.100.136.21 port 44236 [preauth]
Sep 14 09:33:54 nativespace-cdp sshd[1793564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.96.239.88  user=root
Sep 14 09:33:54 nativespace-cdp sshd[1793564]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:33:56 nativespace-cdp sshd[1793564]: Failed password for root from 34.96.239.88 port 47070 ssh2
Sep 14 09:33:56 nativespace-cdp sshd[1793564]: Received disconnect from 34.96.239.88 port 47070:11: Bye Bye [preauth]
Sep 14 09:33:56 nativespace-cdp sshd[1793564]: Disconnected from 34.96.239.88 port 47070 [preauth]
Sep 14 09:33:57 nativespace-cdp sshd[1793581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.75.154.14  user=root
Sep 14 09:33:57 nativespace-cdp sshd[1793581]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:34:00 nativespace-cdp sshd[1793581]: Failed password for root from 186.75.154.14 port 44342 ssh2
Sep 14 09:34:03 nativespace-cdp sshd[1793581]: Received disconnect from 186.75.154.14 port 44342:11: Bye Bye [preauth]
Sep 14 09:34:03 nativespace-cdp sshd[1793581]: Disconnected from 186.75.154.14 port 44342 [preauth]
Sep 14 09:35:21 nativespace-cdp sshd[1793959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.71.21.1  user=root
Sep 14 09:35:21 nativespace-cdp sshd[1793959]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:35:23 nativespace-cdp sshd[1793959]: Failed password for root from 201.71.21.1 port 44326 ssh2
Sep 14 09:35:23 nativespace-cdp sshd[1793959]: Received disconnect from 201.71.21.1 port 44326:11: Bye Bye [preauth]
Sep 14 09:35:23 nativespace-cdp sshd[1793959]: Disconnected from 201.71.21.1 port 44326 [preauth]
Sep 14 09:35:41 nativespace-cdp sshd[1794009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.144.66  user=root
Sep 14 09:35:41 nativespace-cdp sshd[1794009]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:35:43 nativespace-cdp sshd[1794009]: Failed password for root from 36.93.144.66 port 41696 ssh2
Sep 14 09:35:43 nativespace-cdp sshd[1794009]: Received disconnect from 36.93.144.66 port 41696:11: Bye Bye [preauth]
Sep 14 09:35:43 nativespace-cdp sshd[1794009]: Disconnected from 36.93.144.66 port 41696 [preauth]
Sep 14 09:35:48 nativespace-cdp sshd[1794095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.75.154.14  user=root
Sep 14 09:35:48 nativespace-cdp sshd[1794095]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:35:51 nativespace-cdp sshd[1794095]: Failed password for root from 186.75.154.14 port 52388 ssh2
Sep 14 09:35:51 nativespace-cdp sshd[1794095]: Received disconnect from 186.75.154.14 port 52388:11: Bye Bye [preauth]
Sep 14 09:35:51 nativespace-cdp sshd[1794095]: Disconnected from 186.75.154.14 port 52388 [preauth]
Sep 14 09:36:01 nativespace-cdp sshd[1794125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.96.239.88  user=root
Sep 14 09:36:01 nativespace-cdp sshd[1794125]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:36:03 nativespace-cdp sshd[1794125]: Failed password for root from 34.96.239.88 port 41196 ssh2
Sep 14 09:36:03 nativespace-cdp sshd[1794125]: Received disconnect from 34.96.239.88 port 41196:11: Bye Bye [preauth]
Sep 14 09:36:03 nativespace-cdp sshd[1794125]: Disconnected from 34.96.239.88 port 41196 [preauth]
Sep 14 09:36:27 nativespace-cdp sshd[1794193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.71.21.1  user=root
Sep 14 09:36:27 nativespace-cdp sshd[1794193]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:36:29 nativespace-cdp sshd[1794193]: Failed password for root from 201.71.21.1 port 59790 ssh2
Sep 14 09:36:29 nativespace-cdp sshd[1794290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.144.66  user=root
Sep 14 09:36:29 nativespace-cdp sshd[1794290]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:36:29 nativespace-cdp sshd[1794193]: Received disconnect from 201.71.21.1 port 59790:11: Bye Bye [preauth]
Sep 14 09:36:29 nativespace-cdp sshd[1794193]: Disconnected from 201.71.21.1 port 59790 [preauth]
Sep 14 09:36:30 nativespace-cdp sshd[1794290]: Failed password for root from 36.93.144.66 port 33130 ssh2
Sep 14 09:36:35 nativespace-cdp sshd[1794364]: Connection closed by 159.100.136.21 port 53596 [preauth]
Sep 14 09:36:36 nativespace-cdp sshd[1794369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.156.22.179  user=root
Sep 14 09:36:36 nativespace-cdp sshd[1794369]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:36:38 nativespace-cdp sshd[1794369]: Failed password for root from 45.156.22.179 port 52750 ssh2
Sep 14 09:36:38 nativespace-cdp sshd[1794369]: Received disconnect from 45.156.22.179 port 52750:11: Bye Bye [preauth]
Sep 14 09:36:38 nativespace-cdp sshd[1794369]: Disconnected from 45.156.22.179 port 52750 [preauth]
Sep 14 09:36:45 nativespace-cdp sshd[1794392]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.96.239.88  user=root
Sep 14 09:36:45 nativespace-cdp sshd[1794392]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:36:47 nativespace-cdp sshd[1794392]: Failed password for root from 34.96.239.88 port 54556 ssh2
Sep 14 09:36:47 nativespace-cdp sshd[1794392]: Received disconnect from 34.96.239.88 port 54556:11: Bye Bye [preauth]
Sep 14 09:36:47 nativespace-cdp sshd[1794392]: Disconnected from 34.96.239.88 port 54556 [preauth]
Sep 14 09:36:51 nativespace-cdp sshd[1794431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.75.154.14  user=root
Sep 14 09:36:51 nativespace-cdp sshd[1794431]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:36:53 nativespace-cdp sshd[1794431]: Failed password for root from 186.75.154.14 port 36022 ssh2
Sep 14 09:36:53 nativespace-cdp sshd[1794431]: Received disconnect from 186.75.154.14 port 36022:11: Bye Bye [preauth]
Sep 14 09:36:53 nativespace-cdp sshd[1794431]: Disconnected from 186.75.154.14 port 36022 [preauth]
Sep 14 09:41:33 nativespace-cdp sshd[1795570]: Connection closed by 159.100.136.21 port 34912 [preauth]
Sep 14 09:41:34 nativespace-cdp sshd[1795568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.156.22.179  user=root
Sep 14 09:41:34 nativespace-cdp sshd[1795568]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:41:37 nativespace-cdp sshd[1795568]: Failed password for root from 45.156.22.179 port 58958 ssh2
Sep 14 09:41:37 nativespace-cdp sshd[1795568]: Received disconnect from 45.156.22.179 port 58958:11: Bye Bye [preauth]
Sep 14 09:41:37 nativespace-cdp sshd[1795568]: Disconnected from 45.156.22.179 port 58958 [preauth]
Sep 14 09:42:58 nativespace-cdp sshd[1796348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.156.22.179  user=root
Sep 14 09:42:58 nativespace-cdp sshd[1796348]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 09:43:01 nativespace-cdp sshd[1796348]: Failed password for root from 45.156.22.179 port 37132 ssh2
Sep 14 09:46:33 nativespace-cdp sshd[1797368]: Connection closed by 159.100.136.21 port 43780 [preauth]
Sep 14 09:51:33 nativespace-cdp sshd[1798488]: Connection closed by 159.100.136.21 port 53154 [preauth]
Sep 14 09:56:33 nativespace-cdp sshd[1799549]: Connection closed by 159.100.136.21 port 34586 [preauth]
Sep 14 10:01:33 nativespace-cdp sshd[1800948]: Connection closed by 159.100.136.21 port 44210 [preauth]
Sep 14 10:06:33 nativespace-cdp sshd[1802576]: Connection closed by 159.100.136.21 port 54004 [preauth]
Sep 14 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:32 nativespace-cdp sudo[1803235]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:32 nativespace-cdp sudo[1803239]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 10:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:33 nativespace-cdp sudo[1803242]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 10:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:33 nativespace-cdp sudo[1803255]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 10:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:37 nativespace-cdp sudo[1803262]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:37 nativespace-cdp sudo[1803278]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:37 nativespace-cdp sudo[1803283]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:37 nativespace-cdp sudo[1803287]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:37 nativespace-cdp sudo[1803293]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:37 nativespace-cdp sudo[1803300]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 10:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:37 nativespace-cdp sudo[1803305]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 10:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:40 nativespace-cdp sudo[1803320]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 10:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:40 nativespace-cdp sudo[1803326]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=magichat user-2=lbhyisi user-3=hhdugcor user-4=dickemery123 user-5=ptkxhsbt user-6=martsblo user-7=musorguk user-8=megacards user-9=wilsonsw user-10=strathar user-11=sarafoundation user-12=atestord user-13=lakesan1 user-14=brmrjxl user-15=stephani user-16=leereyn1 user-17=still user-18=agproduc user-19=spectrum user-20=hodgesonweb user-21=theblack user-22=jarvisin user-23=ulsukarm user-24=connect9 user-25=athenare user-26=vantagep user-27=maflemin user-28=lbscrmod user-29=foundation user-30=booff user-31=markward user-32=nativene user-33=innovat1 user-34=stuartge user-35=askhform user-36=alexadmin user-37=skyfirec user-38=ggaaorgu user-39=belle user-40=newstoda user-41=bemadonn user-42=bedfords user-43=firstre2 user-44=vivienn1 user-45=battlere user-46=oneoarco user-47=brighto1 user-48=nstriton
Sep 14 10:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=connectedshoppin user-50=thqkgnbz user-51=accooper user-52=ianrayne user-53=putterfi user-54=hubmaster user-55=carsinyo user-56=fetch user-57=milloyco user-58=gilpin user-59=elecleis user-60=firstred user-61=southlon user-62=highlegh user-63=clarkass user-64=firstrel user-65=costestimatorco user-66=coursemc user-67=opaiscyx user-68=jonhartl user-69=seftvta user-70=ultbcrra user-71=firstres user-72=eugincou user-73=courseme user-74=hirefootballgame user-75=pugwash user-76=howardon user-77=paulmca1 user-78=cwsocial user-79=cathski user-80=cambria1 user-81=reliable user-82=ninejimm user-83=hidden user-84=nomistakes user-85=barbersh user-86=tigerlet user-87=isleofwi user-88=smrszyqg user-89=lkpier user-90=ctedorgu user-91=philmcph user-92=steakbridieme user-93=firstre5 user-94=donnychicago user-95=putterfc user-96=nscdp user-97=health2045 user-98=fortunaz user-99=foods user-100=leftie user-101=dhyana
Sep 14 10:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=beauty user-103=eatspam user-104=darkstar user-105=nsceres user-106=burydropin user-107=fawcettd user-108=steve user-109=bwppodcast user-110=zebrapho user-111=asandcoc user-112=sibtoncc user-113=design user-114=ladburyp user-115=dancinggardener user-116=stagingerris user-117=kategilpin user-118=sketchy user-119=cath user-120=havantho user-121=nvihkvu user-122=tstardom user-123=oubpgvbx user-124=what user-125=bakery user-126=sosevalu user-127=crrtipdl user-128=boldover user-129=nove user-130=romaldki user-131=ranxterc user-132=hodgsonmail user-133=outdoorc user-134=branko user-135=onlycont user-136=attlebor user-137=lucy user-138=careers user-139=nbhavers user-140=david user-141=chrisdal user-142=mcdermos user-143=jennimil user-144=tomandle feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 10:09:40 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 10:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:41 nativespace-cdp sudo[1803338]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 10:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:42 nativespace-cdp sudo[1803347]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-U5VD50acpRrlRLDT.~
Sep 14 10:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:42 nativespace-cdp sudo[1803352]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-U5VD50acpRrlRLDT.~'
Sep 14 10:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:42 nativespace-cdp sudo[1803356]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-U5VD50acpRrlRLDT.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 10:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:42 nativespace-cdp sudo[1803362]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 10:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:42 nativespace-cdp sudo[1803367]: pam_unix(sudo:session): session closed for user root
Sep 14 10:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 10:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 10:09:49 nativespace-cdp sudo[1803409]: pam_unix(sudo:session): session closed for user root
Sep 14 10:11:35 nativespace-cdp sshd[1803942]: Connection closed by 159.100.136.21 port 34684 [preauth]
Sep 14 10:16:35 nativespace-cdp sshd[1805553]: Connection closed by 159.100.136.21 port 43440 [preauth]
Sep 14 10:21:33 nativespace-cdp sshd[1806671]: Connection closed by 159.100.136.21 port 52470 [preauth]
Sep 14 10:26:34 nativespace-cdp sshd[1807834]: Connection closed by 159.100.136.21 port 33960 [preauth]
Sep 14 10:31:33 nativespace-cdp sshd[1809673]: Connection closed by 159.100.136.21 port 43182 [preauth]
Sep 14 10:36:33 nativespace-cdp sshd[1810697]: Connection closed by 159.100.136.21 port 52210 [preauth]
Sep 14 10:41:34 nativespace-cdp sshd[1811825]: Connection closed by 159.100.136.21 port 32846 [preauth]
Sep 14 10:46:34 nativespace-cdp sshd[1813047]: Connection closed by 159.100.136.21 port 42446 [preauth]
Sep 14 10:51:33 nativespace-cdp sshd[1814392]: Connection closed by 159.100.136.21 port 51868 [preauth]
Sep 14 10:56:33 nativespace-cdp sshd[1815970]: Connection closed by 159.100.136.21 port 33420 [preauth]
Sep 14 11:01:34 nativespace-cdp sshd[1817675]: Connection closed by 159.100.136.21 port 42884 [preauth]
Sep 14 11:06:33 nativespace-cdp sshd[1818868]: Connection closed by 159.100.136.21 port 51996 [preauth]
Sep 14 11:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 11:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:15 nativespace-cdp sudo[1819402]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 11:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:15 nativespace-cdp sudo[1819405]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 11:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:16 nativespace-cdp sudo[1819408]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 11:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:16 nativespace-cdp sudo[1819418]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 11:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:25 nativespace-cdp sudo[1819421]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 11:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:25 nativespace-cdp sudo[1819464]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 11:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:26 nativespace-cdp sudo[1819469]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 11:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:26 nativespace-cdp sudo[1819473]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 11:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:26 nativespace-cdp sudo[1819479]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 11:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:26 nativespace-cdp sudo[1819485]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 11:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:26 nativespace-cdp sudo[1819490]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 11:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:28 nativespace-cdp sudo[1819502]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 11:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:30 nativespace-cdp sudo[1819510]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:30 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=martsblo user-2=ptkxhsbt user-3=dickemery123 user-4=lbhyisi user-5=hhdugcor user-6=magichat user-7=lakesan1 user-8=brmrjxl user-9=sarafoundation user-10=atestord user-11=strathar user-12=wilsonsw user-13=musorguk user-14=megacards user-15=jarvisin user-16=hodgesonweb user-17=theblack user-18=spectrum user-19=still user-20=agproduc user-21=leereyn1 user-22=stephani user-23=markward user-24=booff user-25=foundation user-26=maflemin user-27=lbscrmod user-28=connect9 user-29=athenare user-30=vantagep user-31=ulsukarm user-32=skyfirec user-33=alexadmin user-34=stuartge user-35=askhform user-36=innovat1 user-37=nativene user-38=brighto1 user-39=nstriton user-40=battlere user-41=oneoarco user-42=firstre2 user-43=vivienn1 user-44=bedfords user-45=bemadonn user-46=belle user-47=ggaaorgu user-48=newstoda
Sep 14 11:09:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=elecleis user-50=milloyco user-51=gilpin user-52=carsinyo user-53=fetch user-54=hubmaster user-55=putterfi user-56=ianrayne user-57=accooper user-58=thqkgnbz user-59=connectedshoppin user-60=firstres user-61=seftvta user-62=jonhartl user-63=ultbcrra user-64=coursemc user-65=opaiscyx user-66=costestimatorco user-67=firstrel user-68=clarkass user-69=southlon user-70=highlegh user-71=firstred user-72=reliable user-73=ninejimm user-74=cambria1 user-75=cathski user-76=paulmca1 user-77=howardon user-78=pugwash user-79=cwsocial user-80=hirefootballgame user-81=courseme user-82=eugincou user-83=health2045 user-84=fortunaz user-85=leftie user-86=foods user-87=putterfc user-88=nscdp user-89=philmcph user-90=ctedorgu user-91=firstre5 user-92=donnychicago user-93=steakbridieme user-94=lkpier user-95=smrszyqg user-96=isleofwi user-97=barbersh user-98=tigerlet user-99=hidden user-100=nomistakes user-101=burydropin
Sep 14 11:09:30 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=fawcettd user-103=nsceres user-104=eatspam user-105=darkstar user-106=beauty user-107=dhyana user-108=asandcoc user-109=sibtoncc user-110=zebrapho user-111=bwppodcast user-112=steve user-113=what user-114=oubpgvbx user-115=tstardom user-116=nvihkvu user-117=cath user-118=sketchy user-119=havantho user-120=kategilpin user-121=ladburyp user-122=dancinggardener user-123=stagingerris user-124=design user-125=nove user-126=boldover user-127=sosevalu user-128=crrtipdl user-129=bakery user-130=attlebor user-131=lucy user-132=onlycont user-133=branko user-134=ranxterc user-135=outdoorc user-136=hodgsonmail user-137=romaldki user-138=tomandle user-139=jennimil user-140=mcdermos user-141=chrisdal user-142=careers user-143=nbhavers user-144=david feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 11:09:30 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 11:09:30 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:31 nativespace-cdp sudo[1819523]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status onlycont
Sep 14 11:09:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:33 nativespace-cdp sudo[1819542]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:33 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=onlycont ; COMMAND=/bin/cagefs_enter.proxied test -e /home/onlycont/wordpress-backups
Sep 14 11:09:33 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user onlycont by (uid=0)
Sep 14 11:09:33 nativespace-cdp sudo[1819553]: pam_unix(sudo:session): session closed for user onlycont
Sep 14 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status oneoarco
Sep 14 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:34 nativespace-cdp sudo[1819567]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 14 11:09:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 11:09:34 nativespace-cdp sudo[1819572]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 11:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status lkpier
Sep 14 11:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:36 nativespace-cdp sudo[1819592]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=lkpier ; COMMAND=/bin/cagefs_enter.proxied test -e /home/lkpier/wordpress-backups
Sep 14 11:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user lkpier by (uid=0)
Sep 14 11:09:37 nativespace-cdp sudo[1819599]: pam_unix(sudo:session): session closed for user lkpier
Sep 14 11:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status bwppodcast
Sep 14 11:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:38 nativespace-cdp sudo[1819615]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=bwppodcast ; COMMAND=/bin/cagefs_enter.proxied test -e /home/bwppodcast/wordpress-backups
Sep 14 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user bwppodcast by (uid=0)
Sep 14 11:09:38 nativespace-cdp sudo[1819621]: pam_unix(sudo:session): session closed for user bwppodcast
Sep 14 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=oneoarco ; COMMAND=/bin/cagefs_enter.proxied test -e /home/oneoarco/wordpress-backups
Sep 14 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user oneoarco by (uid=0)
Sep 14 11:09:38 nativespace-cdp sudo[1819634]: pam_unix(sudo:session): session closed for user oneoarco
Sep 14 11:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status fortunaz
Sep 14 11:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:39 nativespace-cdp sudo[1819647]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=fortunaz ; COMMAND=/bin/cagefs_enter.proxied test -e /home/fortunaz/wordpress-backups
Sep 14 11:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user fortunaz by (uid=0)
Sep 14 11:09:39 nativespace-cdp sudo[1819653]: pam_unix(sudo:session): session closed for user fortunaz
Sep 14 11:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /var/cpanel/licenseid_credentials.json
Sep 14 11:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:39 nativespace-cdp sudo[1819667]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 11:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:39 nativespace-cdp sudo[1819672]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_shared_ip --output=json
Sep 14 11:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:57 nativespace-cdp sudo[1820640]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:57 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_public_ip ip=212.53.87.131 --output=json
Sep 14 11:09:57 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:57 nativespace-cdp sudo[1820646]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:58 nativespace-cdp sudo[1820658]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ptvewo3m3NkiNMgL.~
Sep 14 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:58 nativespace-cdp sudo[1820664]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ptvewo3m3NkiNMgL.~'
Sep 14 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:58 nativespace-cdp sudo[1820668]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ptvewo3m3NkiNMgL.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:58 nativespace-cdp sudo[1820674]: pam_unix(sudo:session): session closed for user root
Sep 14 11:09:58 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 11:09:58 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:09:58 nativespace-cdp sudo[1820679]: pam_unix(sudo:session): session closed for user root
Sep 14 11:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 11:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 11:10:00 nativespace-cdp sudo[1820699]: pam_unix(sudo:session): session closed for user root
Sep 14 11:11:33 nativespace-cdp sshd[1821167]: Connection closed by 159.100.136.21 port 33098 [preauth]
Sep 14 11:16:35 nativespace-cdp sshd[1822876]: Connection closed by 159.100.136.21 port 42620 [preauth]
Sep 14 11:21:36 nativespace-cdp sshd[1824129]: Connection closed by 159.100.136.21 port 52084 [preauth]
Sep 14 11:26:34 nativespace-cdp sshd[1825257]: Connection closed by 159.100.136.21 port 33286 [preauth]
Sep 14 11:31:33 nativespace-cdp sshd[1826871]: Connection closed by 159.100.136.21 port 42066 [preauth]
Sep 14 11:36:33 nativespace-cdp sshd[1828053]: Connection closed by 159.100.136.21 port 51600 [preauth]
Sep 14 11:41:33 nativespace-cdp sshd[1829140]: Connection closed by 159.100.136.21 port 32904 [preauth]
Sep 14 11:46:33 nativespace-cdp sshd[1830686]: Connection closed by 159.100.136.21 port 42178 [preauth]
Sep 14 11:51:36 nativespace-cdp sshd[1831766]: Connection closed by 159.100.136.21 port 51454 [preauth]
Sep 14 11:56:33 nativespace-cdp sshd[1832848]: Connection closed by 159.100.136.21 port 60928 [preauth]
Sep 14 12:01:33 nativespace-cdp sshd[1834645]: Connection closed by 159.100.136.21 port 41838 [preauth]
Sep 14 12:06:34 nativespace-cdp sshd[1835878]: Connection closed by 159.100.136.21 port 51798 [preauth]
Sep 14 12:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 12:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:15 nativespace-cdp sudo[1836481]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 12:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:15 nativespace-cdp sudo[1836485]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 12:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:16 nativespace-cdp sudo[1836490]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 12:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:16 nativespace-cdp sudo[1836497]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 12:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:20 nativespace-cdp sudo[1836503]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 12:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:20 nativespace-cdp sudo[1836518]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 12:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:20 nativespace-cdp sudo[1836523]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 12:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:20 nativespace-cdp sudo[1836527]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 12:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:20 nativespace-cdp sudo[1836532]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 12:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:20 nativespace-cdp sudo[1836537]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 12:09:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:20 nativespace-cdp sudo[1836543]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:25 nativespace-cdp sudo[1836563]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:25 nativespace-cdp sudo[1836572]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:25 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=boldover user-2=nove user-3=bakery user-4=crrtipdl user-5=sosevalu user-6=havantho user-7=cath user-8=sketchy user-9=nvihkvu user-10=oubpgvbx user-11=tstardom user-12=what user-13=design user-14=dancinggardener user-15=stagingerris user-16=ladburyp user-17=kategilpin user-18=jennimil user-19=tomandle user-20=david user-21=careers user-22=nbhavers user-23=chrisdal user-24=mcdermos user-25=onlycont user-26=lucy user-27=attlebor user-28=romaldki user-29=ranxterc user-30=outdoorc user-31=hodgsonmail user-32=branko user-33=lkpier user-34=donnychicago user-35=firstre5 user-36=steakbridieme user-37=ctedorgu user-38=philmcph user-39=nscdp user-40=putterfc user-41=leftie user-42=foods user-43=fortunaz user-44=health2045 user-45=nomistakes user-46=hidden user-47=tigerlet user-48=barbersh user-49=isleofwi
Sep 14 12:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=smrszyqg user-51=cwsocial user-52=pugwash user-53=paulmca1 user-54=howardon user-55=cathski user-56=cambria1 user-57=ninejimm user-58=reliable user-59=eugincou user-60=courseme user-61=hirefootballgame user-62=sibtoncc user-63=asandcoc user-64=steve user-65=bwppodcast user-66=zebrapho user-67=nsceres user-68=fawcettd user-69=burydropin user-70=dhyana user-71=beauty user-72=darkstar user-73=eatspam user-74=vivienn1 user-75=firstre2 user-76=oneoarco user-77=battlere user-78=nstriton user-79=brighto1 user-80=newstoda user-81=belle user-82=ggaaorgu user-83=bemadonn user-84=bedfords user-85=alexadmin user-86=skyfirec user-87=nativene user-88=innovat1 user-89=stuartge user-90=askhform user-91=coursemc user-92=opaiscyx user-93=ultbcrra user-94=jonhartl user-95=seftvta user-96=firstres user-97=firstred user-98=highlegh user-99=southlon user-100=clarkass user-101=firstrel user-102=costestimatorco user-103=putterfi
Sep 14 12:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) user-104=hubmaster user-105=fetch user-106=carsinyo user-107=gilpin user-108=milloyco user-109=elecleis user-110=connectedshoppin user-111=thqkgnbz user-112=accooper user-113=ianrayne user-114=strathar user-115=atestord user-116=sarafoundation user-117=lakesan1 user-118=brmrjxl user-119=megacards user-120=musorguk user-121=wilsonsw user-122=dickemery123 user-123=ptkxhsbt user-124=martsblo user-125=magichat user-126=hhdugcor user-127=lbhyisi user-128=vantagep user-129=connect9 user-130=athenare user-131=lbscrmod user-132=maflemin user-133=booff user-134=foundation user-135=markward user-136=ulsukarm user-137=spectrum user-138=hodgesonweb user-139=theblack user-140=jarvisin user-141=stephani user-142=leereyn1 user-143=agproduc user-144=still feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains feature-9=webprotect
Sep 14 12:09:25 nativespace-cdp sudo: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 12:09:25 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:26 nativespace-cdp sudo[1836578]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 12:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:27 nativespace-cdp sudo[1836587]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-svBvlD0vxtXnyrC8.~
Sep 14 12:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:27 nativespace-cdp sudo[1836593]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-svBvlD0vxtXnyrC8.~'
Sep 14 12:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:27 nativespace-cdp sudo[1836597]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-svBvlD0vxtXnyrC8.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 12:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:27 nativespace-cdp sudo[1836603]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:27 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 12:09:27 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:27 nativespace-cdp sudo[1836608]: pam_unix(sudo:session): session closed for user root
Sep 14 12:09:28 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 12:09:28 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 12:09:28 nativespace-cdp sudo[1836631]: pam_unix(sudo:session): session closed for user root
Sep 14 12:11:33 nativespace-cdp sshd[1837197]: Connection closed by 159.100.136.21 port 33000 [preauth]
Sep 14 12:16:33 nativespace-cdp sshd[1838980]: Connection closed by 159.100.136.21 port 42142 [preauth]
Sep 14 12:21:33 nativespace-cdp sshd[1840339]: Connection closed by 159.100.136.21 port 51596 [preauth]
Sep 14 12:26:33 nativespace-cdp sshd[1841733]: Connection closed by 159.100.136.21 port 33104 [preauth]
Sep 14 12:31:33 nativespace-cdp sshd[1843547]: Connection closed by 159.100.136.21 port 43088 [preauth]
Sep 14 12:36:33 nativespace-cdp sshd[1844729]: Connection closed by 159.100.136.21 port 53122 [preauth]
Sep 14 12:41:35 nativespace-cdp sshd[1845865]: Connection closed by 159.100.136.21 port 34694 [preauth]
Sep 14 12:46:33 nativespace-cdp sshd[1847504]: Connection closed by 159.100.136.21 port 44476 [preauth]
Sep 14 12:51:33 nativespace-cdp sshd[1848515]: Connection closed by 159.100.136.21 port 53762 [preauth]
Sep 14 12:56:34 nativespace-cdp sshd[1849616]: Connection closed by 159.100.136.21 port 33570 [preauth]
Sep 14 13:01:33 nativespace-cdp sshd[1851380]: Connection closed by 159.100.136.21 port 42542 [preauth]
Sep 14 13:06:33 nativespace-cdp sshd[1852832]: Connection closed by 159.100.136.21 port 52026 [preauth]
Sep 14 13:09:28 nativespace-cdp crond[1853872]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 14 13:09:28 nativespace-cdp crond[1853871]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 14 13:09:28 nativespace-cdp crond[1853873]: pam_systemd(crond:session): Failed to create session: Connection timed out
Sep 14 13:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 13:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:19 nativespace-cdp sudo[1854649]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 13:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:19 nativespace-cdp sudo[1854653]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 13:10:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:23 nativespace-cdp sudo[1854656]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 13:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:23 nativespace-cdp sudo[1854690]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:23 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 13:10:23 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:40 nativespace-cdp sudo[1854693]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 13:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:40 nativespace-cdp sudo[1854796]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 13:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:40 nativespace-cdp sudo[1854799]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 13:10:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:40 nativespace-cdp sudo[1854802]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 13:10:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:41 nativespace-cdp sudo[1854805]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 13:10:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:41 nativespace-cdp sudo[1854808]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 13:10:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:41 nativespace-cdp sudo[1854813]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 13:10:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:46 nativespace-cdp sudo[1854882]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 13:10:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:54 nativespace-cdp sudo[1854886]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=firstred user-2=southlon user-3=highlegh user-4=firstrel user-5=clarkass user-6=costestimatorco user-7=coursemc user-8=opaiscyx user-9=seftvta user-10=jonhartl user-11=ultbcrra user-12=firstres user-13=connectedshoppin user-14=thqkgnbz user-15=accooper user-16=ianrayne user-17=putterfi user-18=hubmaster user-19=carsinyo user-20=fetch user-21=gilpin user-22=milloyco user-23=elecleis user-24=belle user-25=ggaaorgu user-26=newstoda user-27=bemadonn user-28=bedfords user-29=firstre2 user-30=vivienn1 user-31=battlere user-32=oneoarco user-33=brighto1 user-34=nstriton user-35=nativene user-36=innovat1 user-37=stuartge user-38=askhform user-39=alexadmin user-40=skyfirec user-41=ulsukarm user-42=connect9 user-43=athenare user-44=vantagep user-45=maflemin user-46=lbscrmod user-47=booff user-48=markward
Sep 14 13:10:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=foundation user-50=stephani user-51=leereyn1 user-52=still user-53=agproduc user-54=spectrum user-55=theblack user-56=hodgesonweb user-57=jarvisin user-58=musorguk user-59=megacards user-60=wilsonsw user-61=strathar user-62=sarafoundation user-63=atestord user-64=lakesan1 user-65=brmrjxl user-66=magichat user-67=lbhyisi user-68=hhdugcor user-69=dickemery123 user-70=ptkxhsbt user-71=martsblo user-72=nbhavers user-73=careers user-74=david user-75=chrisdal user-76=mcdermos user-77=jennimil user-78=tomandle user-79=romaldki user-80=ranxterc user-81=hodgsonmail user-82=outdoorc user-83=branko user-84=onlycont user-85=attlebor user-86=lucy user-87=bakery user-88=sosevalu user-89=crrtipdl user-90=boldover user-91=nove user-92=design user-93=ladburyp user-94=dancinggardener user-95=stagingerris user-96=kategilpin user-97=sketchy user-98=cath user-99=havantho user-100=nvihkvu user-101=tstardom user-102=oubpgvbx
Sep 14 13:10:54 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=what user-104=steve user-105=bwppodcast user-106=zebrapho user-107=asandcoc user-108=sibtoncc user-109=dhyana user-110=beauty user-111=eatspam user-112=darkstar user-113=nsceres user-114=burydropin user-115=fawcettd user-116=hidden user-117=nomistakes user-118=tigerlet user-119=barbersh user-120=smrszyqg user-121=isleofwi user-122=lkpier user-123=ctedorgu user-124=philmcph user-125=firstre5 user-126=steakbridieme user-127=donnychicago user-128=putterfc user-129=nscdp user-130=fortunaz user-131=health2045 user-132=foods user-133=leftie user-134=eugincou user-135=courseme user-136=hirefootballgame user-137=paulmca1 user-138=pugwash user-139=howardon user-140=cwsocial user-141=cambria1 user-142=cathski user-143=reliable user-144=ninejimm feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 13:10:54 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 13:10:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:57 nativespace-cdp sudo[1854952]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 13:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:59 nativespace-cdp sudo[1854987]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EiWnneBvHMUKbVF1.~
Sep 14 13:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:59 nativespace-cdp sudo[1854994]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EiWnneBvHMUKbVF1.~'
Sep 14 13:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:59 nativespace-cdp sudo[1854998]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-EiWnneBvHMUKbVF1.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 13:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:59 nativespace-cdp sudo[1855005]: pam_unix(sudo:session): session closed for user root
Sep 14 13:10:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 13:10:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:10:59 nativespace-cdp sudo[1855009]: pam_unix(sudo:session): session closed for user root
Sep 14 13:11:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 13:11:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 13:11:08 nativespace-cdp sudo[1855099]: pam_unix(sudo:session): session closed for user root
Sep 14 13:11:37 nativespace-cdp sshd[1855261]: Connection closed by 159.100.136.21 port 33164 [preauth]
Sep 14 13:16:34 nativespace-cdp sshd[1857607]: Connection closed by 159.100.136.21 port 42306 [preauth]
Sep 14 13:21:36 nativespace-cdp sshd[1859759]: Connection closed by 159.100.136.21 port 51352 [preauth]
Sep 14 13:26:33 nativespace-cdp sshd[1862575]: Connection closed by 159.100.136.21 port 60728 [preauth]
Sep 14 13:31:33 nativespace-cdp sshd[1866599]: Connection closed by 159.100.136.21 port 41590 [preauth]
Sep 14 13:36:34 nativespace-cdp sshd[1867745]: Connection closed by 159.100.136.21 port 51154 [preauth]
Sep 14 13:41:33 nativespace-cdp sshd[1868918]: Connection closed by 159.100.136.21 port 60064 [preauth]
Sep 14 13:46:33 nativespace-cdp sshd[1870570]: Connection closed by 159.100.136.21 port 41476 [preauth]
Sep 14 13:51:33 nativespace-cdp sshd[1871828]: Connection closed by 159.100.136.21 port 50328 [preauth]
Sep 14 13:56:33 nativespace-cdp sshd[1872926]: Connection closed by 159.100.136.21 port 59832 [preauth]
Sep 14 14:06:35 nativespace-cdp sshd[1875941]: Connection closed by 159.100.136.21 port 50584 [preauth]
Sep 14 14:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 14:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:39 nativespace-cdp sudo[1876613]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 14:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:39 nativespace-cdp sudo[1876618]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 14:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:41 nativespace-cdp sudo[1876624]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:41 nativespace-cdp sudo[1876639]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 14:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:43 nativespace-cdp sudo[1876645]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 14:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:43 nativespace-cdp sudo[1876661]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 14:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:43 nativespace-cdp sudo[1876666]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 14:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:43 nativespace-cdp sudo[1876670]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 14:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:43 nativespace-cdp sudo[1876675]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 14:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:43 nativespace-cdp sudo[1876680]: pam_unix(sudo:session): session closed for user root
Sep 14 14:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 14:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:09:44 nativespace-cdp sudo[1876687]: pam_unix(sudo:session): session closed for user root
Sep 14 14:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 14:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:10:01 nativespace-cdp sudo[1876727]: pam_unix(sudo:session): session closed for user root
Sep 14 14:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 14:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:10:01 nativespace-cdp sudo[1876733]: pam_unix(sudo:session): session closed for user root
Sep 14 14:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hirefootballgame user-2=eugincou user-3=courseme user-4=cathski user-5=cambria1 user-6=ninejimm user-7=reliable user-8=cwsocial user-9=pugwash user-10=paulmca1 user-11=howardon user-12=smrszyqg user-13=isleofwi user-14=nomistakes user-15=hidden user-16=barbersh user-17=tigerlet user-18=nscdp user-19=putterfc user-20=foods user-21=leftie user-22=health2045 user-23=fortunaz user-24=lkpier user-25=firstre5 user-26=steakbridieme user-27=donnychicago user-28=philmcph user-29=ctedorgu user-30=beauty user-31=darkstar user-32=eatspam user-33=dhyana user-34=fawcettd user-35=burydropin user-36=nsceres user-37=bwppodcast user-38=zebrapho user-39=steve user-40=sibtoncc user-41=asandcoc user-42=dancinggardener user-43=stagingerris user-44=ladburyp user-45=kategilpin user-46=design user-47=tstardom
Sep 14 14:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=oubpgvbx user-49=what user-50=havantho user-51=sketchy user-52=cath user-53=nvihkvu user-54=bakery user-55=crrtipdl user-56=sosevalu user-57=nove user-58=boldover user-59=outdoorc user-60=hodgsonmail user-61=ranxterc user-62=branko user-63=romaldki user-64=lucy user-65=attlebor user-66=onlycont user-67=chrisdal user-68=mcdermos user-69=david user-70=careers user-71=nbhavers user-72=tomandle user-73=jennimil user-74=hhdugcor user-75=lbhyisi user-76=magichat user-77=martsblo user-78=dickemery123 user-79=ptkxhsbt user-80=wilsonsw user-81=megacards user-82=musorguk user-83=lakesan1 user-84=brmrjxl user-85=strathar user-86=atestord user-87=sarafoundation user-88=agproduc user-89=still user-90=stephani user-91=leereyn1 user-92=jarvisin user-93=spectrum user-94=theblack user-95=hodgesonweb user-96=ulsukarm user-97=markward user-98=booff user-99=foundation user-100=vantagep user-101=connect9 user-102=athenare
Sep 14 14:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=lbscrmod user-104=maflemin user-105=innovat1 user-106=askhform user-107=stuartge user-108=nativene user-109=alexadmin user-110=skyfirec user-111=bedfords user-112=newstoda user-113=ggaaorgu user-114=belle user-115=bemadonn user-116=nstriton user-117=brighto1 user-118=vivienn1 user-119=firstre2 user-120=oneoarco user-121=battlere user-122=accooper user-123=ianrayne user-124=connectedshoppin user-125=thqkgnbz user-126=milloyco user-127=gilpin user-128=elecleis user-129=hubmaster user-130=putterfi user-131=fetch user-132=carsinyo user-133=firstrel user-134=clarkass user-135=costestimatorco user-136=firstred user-137=highlegh user-138=southlon user-139=ultbcrra user-140=seftvta user-141=jonhartl user-142=firstres user-143=opaiscyx user-144=coursemc feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 14:10:01 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 14:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:10:02 nativespace-cdp sudo[1876741]: pam_unix(sudo:session): session closed for user root
Sep 14 14:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 14:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:10:04 nativespace-cdp sudo[1876871]: pam_unix(sudo:session): session closed for user root
Sep 14 14:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7xwIP5iHbiXtu1SC.~
Sep 14 14:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:10:04 nativespace-cdp sudo[1876877]: pam_unix(sudo:session): session closed for user root
Sep 14 14:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7xwIP5iHbiXtu1SC.~'
Sep 14 14:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:10:04 nativespace-cdp sudo[1876880]: pam_unix(sudo:session): session closed for user root
Sep 14 14:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-7xwIP5iHbiXtu1SC.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 14:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:10:04 nativespace-cdp sudo[1876884]: pam_unix(sudo:session): session closed for user root
Sep 14 14:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 14:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:10:04 nativespace-cdp sudo[1876887]: pam_unix(sudo:session): session closed for user root
Sep 14 14:10:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 14:10:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 14:10:06 nativespace-cdp sudo[1876908]: pam_unix(sudo:session): session closed for user root
Sep 14 14:11:33 nativespace-cdp sshd[1877283]: Connection closed by 159.100.136.21 port 59698 [preauth]
Sep 14 14:16:34 nativespace-cdp sshd[1878940]: Connection closed by 159.100.136.21 port 40806 [preauth]
Sep 14 14:21:34 nativespace-cdp sshd[1880112]: Connection closed by 159.100.136.21 port 50362 [preauth]
Sep 14 14:26:34 nativespace-cdp sshd[1881289]: Connection closed by 159.100.136.21 port 60202 [preauth]
Sep 14 14:31:36 nativespace-cdp sshd[1882963]: Connection closed by 159.100.136.21 port 41220 [preauth]
Sep 14 14:36:34 nativespace-cdp sshd[1884047]: Connection closed by 159.100.136.21 port 50736 [preauth]
Sep 14 14:41:35 nativespace-cdp sshd[1885248]: Connection closed by 159.100.136.21 port 59256 [preauth]
Sep 14 14:46:33 nativespace-cdp sshd[1886863]: Connection closed by 159.100.136.21 port 40282 [preauth]
Sep 14 14:51:33 nativespace-cdp sshd[1888075]: Connection closed by 159.100.136.21 port 49860 [preauth]
Sep 14 14:56:33 nativespace-cdp sshd[1889257]: Connection closed by 159.100.136.21 port 59110 [preauth]
Sep 14 15:01:33 nativespace-cdp sshd[1890508]: Connection closed by 159.100.136.21 port 40232 [preauth]
Sep 14 15:06:34 nativespace-cdp sshd[1891729]: Connection closed by 159.100.136.21 port 49668 [preauth]
Sep 14 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:35 nativespace-cdp sudo[1892453]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:35 nativespace-cdp sudo[1892457]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 15:09:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:36 nativespace-cdp sudo[1892463]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:36 nativespace-cdp sudo[1892471]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 15:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:38 nativespace-cdp sudo[1892477]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 15:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:38 nativespace-cdp sudo[1892493]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 15:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:38 nativespace-cdp sudo[1892498]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 15:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:38 nativespace-cdp sudo[1892503]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 15:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:38 nativespace-cdp sudo[1892508]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 15:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:38 nativespace-cdp sudo[1892514]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 15:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:39 nativespace-cdp sudo[1892520]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:46 nativespace-cdp sudo[1892546]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:46 nativespace-cdp sudo[1892553]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:46 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=attlebor user-2=lucy user-3=onlycont user-4=outdoorc user-5=ranxterc user-6=hodgsonmail user-7=branko user-8=romaldki user-9=tomandle user-10=jennimil user-11=chrisdal user-12=mcdermos user-13=careers user-14=nbhavers user-15=david user-16=tstardom user-17=oubpgvbx user-18=what user-19=sketchy user-20=cath user-21=havantho user-22=nvihkvu user-23=ladburyp user-24=dancinggardener user-25=stagingerris user-26=kategilpin user-27=design user-28=nove user-29=boldover user-30=bakery user-31=sosevalu user-32=crrtipdl user-33=burydropin user-34=fawcettd user-35=nsceres user-36=beauty user-37=eatspam user-38=darkstar user-39=dhyana user-40=asandcoc user-41=sibtoncc user-42=bwppodcast user-43=zebrapho user-44=steve user-45=cambria1 user-46=cathski user-47=reliable user-48=ninejimm user-49=paulmca1
Sep 14 15:09:46 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=howardon user-51=pugwash user-52=cwsocial user-53=hirefootballgame user-54=eugincou user-55=courseme user-56=putterfc user-57=nscdp user-58=fortunaz user-59=health2045 user-60=leftie user-61=foods user-62=lkpier user-63=ctedorgu user-64=philmcph user-65=donnychicago user-66=firstre5 user-67=steakbridieme user-68=isleofwi user-69=smrszyqg user-70=hidden user-71=nomistakes user-72=barbersh user-73=tigerlet user-74=gilpin user-75=milloyco user-76=elecleis user-77=hubmaster user-78=putterfi user-79=carsinyo user-80=fetch user-81=accooper user-82=ianrayne user-83=connectedshoppin user-84=thqkgnbz user-85=seftvta user-86=jonhartl user-87=ultbcrra user-88=firstres user-89=coursemc user-90=opaiscyx user-91=clarkass user-92=firstrel user-93=costestimatorco user-94=firstred user-95=southlon user-96=highlegh user-97=skyfirec user-98=alexadmin user-99=innovat1 user-100=askhform user-101=stuartge user-102=nativene
Sep 14 15:09:46 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=brighto1 user-104=nstriton user-105=firstre2 user-106=vivienn1 user-107=battlere user-108=oneoarco user-109=bedfords user-110=belle user-111=ggaaorgu user-112=newstoda user-113=bemadonn user-114=jarvisin user-115=spectrum user-116=theblack user-117=hodgesonweb user-118=still user-119=agproduc user-120=stephani user-121=leereyn1 user-122=foundation user-123=booff user-124=markward user-125=athenare user-126=connect9 user-127=vantagep user-128=maflemin user-129=lbscrmod user-130=ulsukarm user-131=martsblo user-132=dickemery123 user-133=ptkxhsbt user-134=lbhyisi user-135=hhdugcor user-136=magichat user-137=lakesan1 user-138=brmrjxl user-139=strathar user-140=sarafoundation user-141=atestord user-142=wilsonsw user-143=musorguk user-144=megacards feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 15:09:46 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 15:09:46 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:47 nativespace-cdp sudo[1892560]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 15:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:47 nativespace-cdp sudo[1892569]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kMrEmSfC8vbeE9cr.~
Sep 14 15:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:47 nativespace-cdp sudo[1892574]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kMrEmSfC8vbeE9cr.~'
Sep 14 15:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:47 nativespace-cdp sudo[1892578]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-kMrEmSfC8vbeE9cr.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 15:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:47 nativespace-cdp sudo[1892584]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 15:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:47 nativespace-cdp sudo[1892589]: pam_unix(sudo:session): session closed for user root
Sep 14 15:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 15:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 15:09:55 nativespace-cdp sudo[1892624]: pam_unix(sudo:session): session closed for user root
Sep 14 15:11:36 nativespace-cdp sshd[1893106]: Connection closed by 159.100.136.21 port 58990 [preauth]
Sep 14 15:16:35 nativespace-cdp sshd[1894961]: Connection closed by 159.100.136.21 port 39800 [preauth]
Sep 14 15:21:33 nativespace-cdp sshd[1896280]: Connection closed by 159.100.136.21 port 48238 [preauth]
Sep 14 15:26:33 nativespace-cdp sshd[1897306]: Connection closed by 159.100.136.21 port 57838 [preauth]
Sep 14 15:31:35 nativespace-cdp sshd[1898957]: Connection closed by 159.100.136.21 port 38832 [preauth]
Sep 14 15:36:33 nativespace-cdp sshd[1900157]: Connection closed by 159.100.136.21 port 48028 [preauth]
Sep 14 15:41:33 nativespace-cdp sshd[1908009]: Connection closed by 159.100.136.21 port 57140 [preauth]
Sep 14 15:46:33 nativespace-cdp sshd[1923948]: Connection closed by 159.100.136.21 port 38030 [preauth]
Sep 14 15:51:33 nativespace-cdp sshd[1928386]: Connection closed by 159.100.136.21 port 47652 [preauth]
Sep 14 15:56:34 nativespace-cdp sshd[1929726]: Connection closed by 159.100.136.21 port 56536 [preauth]
Sep 14 16:01:35 nativespace-cdp sshd[1931408]: Connection closed by 159.100.136.21 port 37668 [preauth]
Sep 14 16:06:36 nativespace-cdp sshd[1932535]: Connection closed by 159.100.136.21 port 47116 [preauth]
Sep 14 16:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 16:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:39 nativespace-cdp sudo[1933287]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 16:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:39 nativespace-cdp sudo[1933290]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 16:09:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:40 nativespace-cdp sudo[1933297]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 16:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:40 nativespace-cdp sudo[1933313]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 16:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:43 nativespace-cdp sudo[1933320]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 16:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:43 nativespace-cdp sudo[1933336]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 16:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:43 nativespace-cdp sudo[1933341]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 16:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:43 nativespace-cdp sudo[1933345]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 16:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:43 nativespace-cdp sudo[1933350]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 16:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:43 nativespace-cdp sudo[1933356]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 16:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:43 nativespace-cdp sudo[1933362]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 16:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:09:59 nativespace-cdp sudo[1933400]: pam_unix(sudo:session): session closed for user root
Sep 14 16:09:59 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 16:09:59 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:10:00 nativespace-cdp sudo[1933406]: pam_unix(sudo:session): session closed for user root
Sep 14 16:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=david user-2=careers user-3=nbhavers user-4=mcdermos user-5=chrisdal user-6=jennimil user-7=tomandle user-8=romaldki user-9=branko user-10=outdoorc user-11=hodgsonmail user-12=ranxterc user-13=onlycont user-14=lucy user-15=attlebor user-16=crrtipdl user-17=sosevalu user-18=bakery user-19=boldover user-20=nove user-21=design user-22=kategilpin user-23=dancinggardener user-24=stagingerris user-25=ladburyp user-26=nvihkvu user-27=havantho user-28=sketchy user-29=cath user-30=what user-31=tstardom user-32=oubpgvbx user-33=steve user-34=zebrapho user-35=bwppodcast user-36=sibtoncc user-37=asandcoc user-38=dhyana user-39=darkstar user-40=eatspam user-41=beauty user-42=nsceres user-43=fawcettd user-44=burydropin user-45=tigerlet user-46=barbersh user-47=nomistakes user-48=hidden user-49=isleofwi
Sep 14 16:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=smrszyqg user-51=donnychicago user-52=steakbridieme user-53=firstre5 user-54=ctedorgu user-55=philmcph user-56=lkpier user-57=foods user-58=leftie user-59=fortunaz user-60=health2045 user-61=nscdp user-62=putterfc user-63=courseme user-64=eugincou user-65=hirefootballgame user-66=cwsocial user-67=pugwash user-68=paulmca1 user-69=howardon user-70=reliable user-71=ninejimm user-72=cathski user-73=cambria1 user-74=highlegh user-75=southlon user-76=firstred user-77=costestimatorco user-78=clarkass user-79=firstrel user-80=opaiscyx user-81=coursemc user-82=firstres user-83=ultbcrra user-84=jonhartl user-85=seftvta user-86=thqkgnbz user-87=connectedshoppin user-88=ianrayne user-89=accooper user-90=fetch user-91=carsinyo user-92=putterfi user-93=hubmaster user-94=elecleis user-95=gilpin user-96=milloyco user-97=bemadonn user-98=newstoda user-99=belle user-100=ggaaorgu user-101=bedfords user-102=oneoarco
Sep 14 16:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=battlere user-104=vivienn1 user-105=firstre2 user-106=nstriton user-107=brighto1 user-108=nativene user-109=askhform user-110=stuartge user-111=innovat1 user-112=alexadmin user-113=skyfirec user-114=ulsukarm user-115=lbscrmod user-116=maflemin user-117=vantagep user-118=athenare user-119=connect9 user-120=foundation user-121=booff user-122=markward user-123=leereyn1 user-124=stephani user-125=agproduc user-126=still user-127=hodgesonweb user-128=theblack user-129=spectrum user-130=jarvisin user-131=megacards user-132=musorguk user-133=wilsonsw user-134=atestord user-135=sarafoundation user-136=strathar user-137=brmrjxl user-138=lakesan1 user-139=magichat user-140=hhdugcor user-141=lbhyisi user-142=ptkxhsbt user-143=dickemery123 user-144=martsblo feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 16:10:00 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 16:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:10:01 nativespace-cdp sudo[1933416]: pam_unix(sudo:session): session closed for user root
Sep 14 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:10:02 nativespace-cdp sudo[1933504]: pam_unix(sudo:session): session closed for user root
Sep 14 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ZATaVGN6LRXtwSlL.~
Sep 14 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:10:02 nativespace-cdp sudo[1933511]: pam_unix(sudo:session): session closed for user root
Sep 14 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ZATaVGN6LRXtwSlL.~'
Sep 14 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:10:02 nativespace-cdp sudo[1933516]: pam_unix(sudo:session): session closed for user root
Sep 14 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-ZATaVGN6LRXtwSlL.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:10:02 nativespace-cdp sudo[1933521]: pam_unix(sudo:session): session closed for user root
Sep 14 16:10:02 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 16:10:02 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:10:02 nativespace-cdp sudo[1933526]: pam_unix(sudo:session): session closed for user root
Sep 14 16:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 16:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 16:10:04 nativespace-cdp sudo[1933579]: pam_unix(sudo:session): session closed for user root
Sep 14 16:11:33 nativespace-cdp sshd[1933946]: Connection closed by 159.100.136.21 port 55958 [preauth]
Sep 14 16:16:33 nativespace-cdp sshd[1935554]: Connection closed by 159.100.136.21 port 37018 [preauth]
Sep 14 16:21:33 nativespace-cdp sshd[1936727]: Connection closed by 159.100.136.21 port 46604 [preauth]
Sep 14 16:26:33 nativespace-cdp sshd[1937917]: Connection closed by 159.100.136.21 port 55866 [preauth]
Sep 14 16:31:35 nativespace-cdp sshd[1939599]: Connection closed by 159.100.136.21 port 36650 [preauth]
Sep 14 16:36:34 nativespace-cdp sshd[1940686]: Connection closed by 159.100.136.21 port 46474 [preauth]
Sep 14 16:41:34 nativespace-cdp sshd[1941814]: Connection closed by 159.100.136.21 port 55768 [preauth]
Sep 14 16:46:34 nativespace-cdp sshd[1943388]: Connection closed by 159.100.136.21 port 36858 [preauth]
Sep 14 16:51:33 nativespace-cdp sshd[1944472]: Connection closed by 159.100.136.21 port 46020 [preauth]
Sep 14 16:56:34 nativespace-cdp sshd[1945594]: Connection closed by 159.100.136.21 port 56028 [preauth]
Sep 14 17:01:36 nativespace-cdp sshd[1947086]: Connection closed by 159.100.136.21 port 37156 [preauth]
Sep 14 17:06:34 nativespace-cdp sshd[1948385]: Connection closed by 159.100.136.21 port 46268 [preauth]
Sep 14 17:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 17:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:09:40 nativespace-cdp sudo[1949172]: pam_unix(sudo:session): session closed for user root
Sep 14 17:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 17:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:09:40 nativespace-cdp sudo[1949178]: pam_unix(sudo:session): session closed for user root
Sep 14 17:09:40 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 17:09:40 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:09:42 nativespace-cdp sudo[1949183]: pam_unix(sudo:session): session closed for user root
Sep 14 17:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 17:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:09:42 nativespace-cdp sudo[1949195]: pam_unix(sudo:session): session closed for user root
Sep 14 17:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 17:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:04 nativespace-cdp sudo[1949201]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:04 nativespace-cdp sudo[1949540]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:04 nativespace-cdp sudo[1949543]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:04 nativespace-cdp sudo[1949546]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:04 nativespace-cdp sudo[1949549]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:04 nativespace-cdp sudo[1949552]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:04 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 17:10:04 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:04 nativespace-cdp sudo[1949555]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 17:10:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:13 nativespace-cdp sudo[1949600]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 17:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:14 nativespace-cdp sudo[1949609]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=asandcoc user-2=sibtoncc user-3=bwppodcast user-4=zebrapho user-5=steve user-6=burydropin user-7=fawcettd user-8=nsceres user-9=beauty user-10=eatspam user-11=darkstar user-12=dhyana user-13=putterfc user-14=nscdp user-15=fortunaz user-16=health2045 user-17=leftie user-18=foods user-19=lkpier user-20=philmcph user-21=ctedorgu user-22=donnychicago user-23=steakbridieme user-24=firstre5 user-25=isleofwi user-26=smrszyqg user-27=hidden user-28=nomistakes user-29=barbersh user-30=tigerlet user-31=cambria1 user-32=cathski user-33=ninejimm user-34=reliable user-35=howardon user-36=paulmca1 user-37=pugwash user-38=cwsocial user-39=hirefootballgame user-40=eugincou user-41=courseme user-42=tomandle user-43=jennimil user-44=chrisdal user-45=mcdermos user-46=careers user-47=nbhavers user-48=david
Sep 14 17:10:14 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=attlebor user-50=lucy user-51=onlycont user-52=outdoorc user-53=ranxterc user-54=hodgsonmail user-55=branko user-56=romaldki user-57=nove user-58=boldover user-59=bakery user-60=sosevalu user-61=crrtipdl user-62=tstardom user-63=oubpgvbx user-64=what user-65=sketchy user-66=cath user-67=havantho user-68=nvihkvu user-69=ladburyp user-70=dancinggardener user-71=stagingerris user-72=kategilpin user-73=design user-74=foundation user-75=booff user-76=markward user-77=athenare user-78=connect9 user-79=vantagep user-80=maflemin user-81=lbscrmod user-82=ulsukarm user-83=jarvisin user-84=spectrum user-85=theblack user-86=hodgesonweb user-87=still user-88=agproduc user-89=stephani user-90=leereyn1 user-91=lakesan1 user-92=brmrjxl user-93=strathar user-94=sarafoundation user-95=atestord user-96=wilsonsw user-97=musorguk user-98=megacards user-99=martsblo user-100=dickemery123 user-101=ptkxhsbt user-102=lbhyisi
Sep 14 17:10:14 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=hhdugcor user-104=magichat user-105=seftvta user-106=jonhartl user-107=ultbcrra user-108=firstres user-109=opaiscyx user-110=coursemc user-111=firstrel user-112=clarkass user-113=costestimatorco user-114=firstred user-115=southlon user-116=highlegh user-117=milloyco user-118=gilpin user-119=elecleis user-120=putterfi user-121=hubmaster user-122=carsinyo user-123=fetch user-124=accooper user-125=ianrayne user-126=connectedshoppin user-127=thqkgnbz user-128=brighto1 user-129=nstriton user-130=firstre2 user-131=vivienn1 user-132=battlere user-133=oneoarco user-134=bedfords user-135=ggaaorgu user-136=belle user-137=newstoda user-138=bemadonn user-139=alexadmin user-140=skyfirec user-141=innovat1 user-142=askhform user-143=stuartge user-144=nativene feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 17:10:14 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 17:10:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:16 nativespace-cdp sudo[1949620]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 17:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:16 nativespace-cdp sudo[1949638]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hsbxVoPFu4oNa8QO.~
Sep 14 17:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:16 nativespace-cdp sudo[1949644]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hsbxVoPFu4oNa8QO.~'
Sep 14 17:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:16 nativespace-cdp sudo[1949649]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-hsbxVoPFu4oNa8QO.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 17:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:16 nativespace-cdp sudo[1949654]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 17:10:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:16 nativespace-cdp sudo[1949659]: pam_unix(sudo:session): session closed for user root
Sep 14 17:10:32 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 17:10:32 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 17:10:32 nativespace-cdp sudo[1949707]: pam_unix(sudo:session): session closed for user root
Sep 14 17:11:33 nativespace-cdp sshd[1949914]: Connection closed by 159.100.136.21 port 55136 [preauth]
Sep 14 17:16:33 nativespace-cdp sshd[1951421]: Connection closed by 159.100.136.21 port 36650 [preauth]
Sep 14 17:21:33 nativespace-cdp sshd[1952703]: Connection closed by 159.100.136.21 port 45966 [preauth]
Sep 14 17:26:33 nativespace-cdp sshd[1953817]: Connection closed by 159.100.136.21 port 55526 [preauth]
Sep 14 17:31:33 nativespace-cdp sshd[1955124]: Connection closed by 159.100.136.21 port 35636 [preauth]
Sep 14 17:36:34 nativespace-cdp sshd[1956351]: Connection closed by 159.100.136.21 port 45308 [preauth]
Sep 14 17:41:33 nativespace-cdp sshd[1957685]: Connection closed by 159.100.136.21 port 54698 [preauth]
Sep 14 17:46:35 nativespace-cdp sshd[1959672]: Connection closed by 159.100.136.21 port 35952 [preauth]
Sep 14 17:51:33 nativespace-cdp sshd[1960811]: Connection closed by 159.100.136.21 port 45034 [preauth]
Sep 14 17:56:33 nativespace-cdp sshd[1961873]: Connection closed by 159.100.136.21 port 54430 [preauth]
Sep 14 18:01:33 nativespace-cdp sshd[1963108]: Connection closed by 159.100.136.21 port 35456 [preauth]
Sep 14 18:06:33 nativespace-cdp sshd[1964259]: Connection closed by 159.100.136.21 port 45662 [preauth]
Sep 14 18:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 18:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:37 nativespace-cdp sudo[1964859]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 18:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:37 nativespace-cdp sudo[1964864]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 18:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:38 nativespace-cdp sudo[1964870]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 18:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:38 nativespace-cdp sudo[1964877]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 18:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:42 nativespace-cdp sudo[1964883]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:43 nativespace-cdp sudo[1964907]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:43 nativespace-cdp sudo[1964912]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:43 nativespace-cdp sudo[1964916]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:43 nativespace-cdp sudo[1964921]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:43 nativespace-cdp sudo[1964927]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 18:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:43 nativespace-cdp sudo[1964932]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 18:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:52 nativespace-cdp sudo[1964962]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 18:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:53 nativespace-cdp sudo[1964968]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=battlere user-2=oneoarco user-3=firstre2 user-4=vivienn1 user-5=brighto1 user-6=nstriton user-7=bemadonn user-8=ggaaorgu user-9=belle user-10=newstoda user-11=bedfords user-12=skyfirec user-13=alexadmin user-14=nativene user-15=askhform user-16=stuartge user-17=innovat1 user-18=opaiscyx user-19=coursemc user-20=firstres user-21=jonhartl user-22=seftvta user-23=ultbcrra user-24=southlon user-25=highlegh user-26=firstred user-27=costestimatorco user-28=clarkass user-29=firstrel user-30=carsinyo user-31=fetch user-32=putterfi user-33=hubmaster user-34=elecleis user-35=milloyco user-36=gilpin user-37=thqkgnbz user-38=connectedshoppin user-39=ianrayne user-40=accooper user-41=sarafoundation user-42=atestord user-43=strathar user-44=lakesan1 user-45=brmrjxl user-46=musorguk user-47=megacards
Sep 14 18:09:53 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=wilsonsw user-49=ptkxhsbt user-50=dickemery123 user-51=martsblo user-52=magichat user-53=lbhyisi user-54=hhdugcor user-55=maflemin user-56=lbscrmod user-57=connect9 user-58=athenare user-59=vantagep user-60=markward user-61=booff user-62=foundation user-63=ulsukarm user-64=theblack user-65=hodgesonweb user-66=spectrum user-67=jarvisin user-68=leereyn1 user-69=stephani user-70=still user-71=agproduc user-72=boldover user-73=nove user-74=sosevalu user-75=crrtipdl user-76=bakery user-77=nvihkvu user-78=sketchy user-79=cath user-80=havantho user-81=what user-82=oubpgvbx user-83=tstardom user-84=design user-85=kategilpin user-86=ladburyp user-87=dancinggardener user-88=stagingerris user-89=jennimil user-90=tomandle user-91=nbhavers user-92=careers user-93=david user-94=mcdermos user-95=chrisdal user-96=onlycont user-97=attlebor user-98=lucy user-99=romaldki user-100=branko user-101=hodgsonmail
Sep 14 18:09:53 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=ranxterc user-103=outdoorc user-104=philmcph user-105=ctedorgu user-106=steakbridieme user-107=firstre5 user-108=donnychicago user-109=lkpier user-110=health2045 user-111=fortunaz user-112=leftie user-113=foods user-114=putterfc user-115=nscdp user-116=barbersh user-117=tigerlet user-118=hidden user-119=nomistakes user-120=isleofwi user-121=smrszyqg user-122=howardon user-123=pugwash user-124=paulmca1 user-125=cwsocial user-126=ninejimm user-127=reliable user-128=cathski user-129=cambria1 user-130=courseme user-131=eugincou user-132=hirefootballgame user-133=asandcoc user-134=sibtoncc user-135=steve user-136=zebrapho user-137=bwppodcast user-138=nsceres user-139=burydropin user-140=fawcettd user-141=dhyana user-142=eatspam user-143=darkstar user-144=beauty feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains
Sep 14 18:09:53 nativespace-cdp sudo: wp-toolkit : (command continued) feature-8=subdomains feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 18:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:54 nativespace-cdp sudo[1964977]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:54 nativespace-cdp sudo[1964984]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-bKnlXrccSwAatWep.~
Sep 14 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:54 nativespace-cdp sudo[1964990]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-bKnlXrccSwAatWep.~'
Sep 14 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:54 nativespace-cdp sudo[1964994]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-bKnlXrccSwAatWep.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:54 nativespace-cdp sudo[1965000]: pam_unix(sudo:session): session closed for user root
Sep 14 18:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 18:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:09:54 nativespace-cdp sudo[1965005]: pam_unix(sudo:session): session closed for user root
Sep 14 18:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 18:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 18:10:01 nativespace-cdp sudo[1965039]: pam_unix(sudo:session): session closed for user root
Sep 14 18:11:33 nativespace-cdp sshd[1965703]: Connection closed by 159.100.136.21 port 54950 [preauth]
Sep 14 18:16:33 nativespace-cdp sshd[1967300]: Connection closed by 159.100.136.21 port 35710 [preauth]
Sep 14 18:21:33 nativespace-cdp sshd[1968381]: Connection closed by 159.100.136.21 port 44560 [preauth]
Sep 14 18:23:23 nativespace-cdp sshd[1968730]: Did not receive identification string from 87.236.176.190 port 56343
Sep 14 18:23:23 nativespace-cdp sshd[1968738]: Connection closed by 87.236.176.190 port 37551 [preauth]
Sep 14 18:26:33 nativespace-cdp sshd[1969521]: Connection closed by 159.100.136.21 port 53566 [preauth]
Sep 14 18:31:33 nativespace-cdp sshd[1970864]: Connection closed by 159.100.136.21 port 34582 [preauth]
Sep 14 18:36:33 nativespace-cdp sshd[1972310]: Connection closed by 159.100.136.21 port 44236 [preauth]
Sep 14 18:41:34 nativespace-cdp sshd[1973539]: Connection closed by 159.100.136.21 port 53546 [preauth]
Sep 14 18:46:33 nativespace-cdp sshd[1975057]: Connection closed by 159.100.136.21 port 35168 [preauth]
Sep 14 18:51:33 nativespace-cdp sshd[1976126]: Connection closed by 159.100.136.21 port 44458 [preauth]
Sep 14 18:56:34 nativespace-cdp sshd[1977220]: Connection closed by 159.100.136.21 port 53824 [preauth]
Sep 14 19:01:35 nativespace-cdp sshd[1978459]: Connection closed by 159.100.136.21 port 34664 [preauth]
Sep 14 19:06:33 nativespace-cdp sshd[1979642]: Connection closed by 159.100.136.21 port 44012 [preauth]
Sep 14 19:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 19:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:41 nativespace-cdp sudo[1980329]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 19:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:41 nativespace-cdp sudo[1980335]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:41 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 19:09:41 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:43 nativespace-cdp sudo[1980340]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:43 nativespace-cdp sudo[1980352]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 19:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:47 nativespace-cdp sudo[1980358]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 19:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:47 nativespace-cdp sudo[1980378]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 19:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:47 nativespace-cdp sudo[1980383]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 19:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:47 nativespace-cdp sudo[1980387]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 19:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:47 nativespace-cdp sudo[1980392]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 19:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:47 nativespace-cdp sudo[1980398]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:47 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 19:09:47 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:47 nativespace-cdp sudo[1980404]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 19:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:50 nativespace-cdp sudo[1980417]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 19:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:52 nativespace-cdp sudo[1980425]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=burydropin user-2=fawcettd user-3=nsceres user-4=eatspam user-5=darkstar user-6=beauty user-7=dhyana user-8=asandcoc user-9=sibtoncc user-10=zebrapho user-11=bwppodcast user-12=steve user-13=reliable user-14=ninejimm user-15=cambria1 user-16=cathski user-17=pugwash user-18=howardon user-19=paulmca1 user-20=cwsocial user-21=hirefootballgame user-22=courseme user-23=eugincou user-24=fortunaz user-25=health2045 user-26=leftie user-27=foods user-28=putterfc user-29=nscdp user-30=philmcph user-31=ctedorgu user-32=firstre5 user-33=donnychicago user-34=steakbridieme user-35=lkpier user-36=isleofwi user-37=smrszyqg user-38=barbersh user-39=tigerlet user-40=hidden user-41=nomistakes user-42=attlebor user-43=lucy user-44=onlycont user-45=branko user-46=ranxterc user-47=outdoorc user-48=hodgsonmail
Sep 14 19:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=romaldki user-50=tomandle user-51=jennimil user-52=mcdermos user-53=chrisdal user-54=careers user-55=nbhavers user-56=david user-57=what user-58=oubpgvbx user-59=tstardom user-60=nvihkvu user-61=sketchy user-62=cath user-63=havantho user-64=kategilpin user-65=ladburyp user-66=dancinggardener user-67=stagingerris user-68=design user-69=nove user-70=boldover user-71=sosevalu user-72=crrtipdl user-73=bakery user-74=jarvisin user-75=hodgesonweb user-76=theblack user-77=spectrum user-78=still user-79=agproduc user-80=leereyn1 user-81=stephani user-82=booff user-83=markward user-84=foundation user-85=maflemin user-86=lbscrmod user-87=athenare user-88=connect9 user-89=vantagep user-90=ulsukarm user-91=martsblo user-92=ptkxhsbt user-93=dickemery123 user-94=lbhyisi user-95=hhdugcor user-96=magichat user-97=lakesan1 user-98=brmrjxl user-99=sarafoundation user-100=atestord user-101=strathar user-102=wilsonsw
Sep 14 19:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=musorguk user-104=megacards user-105=elecleis user-106=milloyco user-107=gilpin user-108=carsinyo user-109=fetch user-110=putterfi user-111=hubmaster user-112=ianrayne user-113=accooper user-114=thqkgnbz user-115=connectedshoppin user-116=firstres user-117=jonhartl user-118=seftvta user-119=ultbcrra user-120=opaiscyx user-121=coursemc user-122=costestimatorco user-123=clarkass user-124=firstrel user-125=southlon user-126=highlegh user-127=firstred user-128=alexadmin user-129=skyfirec user-130=stuartge user-131=askhform user-132=innovat1 user-133=nativene user-134=brighto1 user-135=nstriton user-136=battlere user-137=oneoarco user-138=firstre2 user-139=vivienn1 user-140=bedfords user-141=bemadonn user-142=ggaaorgu user-143=belle user-144=newstoda feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 19:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 19:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:53 nativespace-cdp sudo[1980435]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:54 nativespace-cdp sudo[1980443]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-TbCxy4bwjsnCbjpc.~
Sep 14 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:54 nativespace-cdp sudo[1980448]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-TbCxy4bwjsnCbjpc.~'
Sep 14 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:54 nativespace-cdp sudo[1980452]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-TbCxy4bwjsnCbjpc.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:54 nativespace-cdp sudo[1980459]: pam_unix(sudo:session): session closed for user root
Sep 14 19:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 19:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:09:54 nativespace-cdp sudo[1980464]: pam_unix(sudo:session): session closed for user root
Sep 14 19:10:01 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 19:10:01 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 19:10:01 nativespace-cdp sudo[1980514]: pam_unix(sudo:session): session closed for user root
Sep 14 19:11:36 nativespace-cdp sshd[1981192]: Connection closed by 159.100.136.21 port 52870 [preauth]
Sep 14 19:16:34 nativespace-cdp sshd[1982654]: Connection closed by 159.100.136.21 port 34264 [preauth]
Sep 14 19:21:33 nativespace-cdp sshd[1983780]: Connection closed by 159.100.136.21 port 43036 [preauth]
Sep 14 19:26:35 nativespace-cdp sshd[1984820]: Connection closed by 159.100.136.21 port 52364 [preauth]
Sep 14 19:31:33 nativespace-cdp sshd[1986211]: Connection closed by 159.100.136.21 port 33402 [preauth]
Sep 14 19:35:01 nativespace-cdp sshd[1987098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.48.65.150  user=root
Sep 14 19:35:01 nativespace-cdp sshd[1987098]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:35:04 nativespace-cdp sshd[1987098]: Failed password for root from 181.48.65.150 port 40066 ssh2
Sep 14 19:35:04 nativespace-cdp sshd[1987098]: Received disconnect from 181.48.65.150 port 40066:11: Bye Bye [preauth]
Sep 14 19:35:04 nativespace-cdp sshd[1987098]: Disconnected from 181.48.65.150 port 40066 [preauth]
Sep 14 19:36:03 nativespace-cdp sshd[1987564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.34.106.146  user=root
Sep 14 19:36:03 nativespace-cdp sshd[1987564]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:36:04 nativespace-cdp sshd[1987564]: Failed password for root from 114.34.106.146 port 55952 ssh2
Sep 14 19:36:09 nativespace-cdp sshd[1987564]: Received disconnect from 114.34.106.146 port 55952:11: Bye Bye [preauth]
Sep 14 19:36:09 nativespace-cdp sshd[1987564]: Disconnected from 114.34.106.146 port 55952 [preauth]
Sep 14 19:36:33 nativespace-cdp sshd[1987648]: Connection closed by 159.100.136.21 port 42648 [preauth]
Sep 14 19:38:37 nativespace-cdp sshd[1987976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.124.148  user=root
Sep 14 19:38:37 nativespace-cdp sshd[1987976]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:38:39 nativespace-cdp sshd[1987976]: Failed password for root from 47.236.124.148 port 55056 ssh2
Sep 14 19:38:40 nativespace-cdp sshd[1987976]: Received disconnect from 47.236.124.148 port 55056:11: Bye Bye [preauth]
Sep 14 19:38:40 nativespace-cdp sshd[1987976]: Disconnected from 47.236.124.148 port 55056 [preauth]
Sep 14 19:40:35 nativespace-cdp sshd[1988423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.101.75  user=root
Sep 14 19:40:35 nativespace-cdp sshd[1988423]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:40:37 nativespace-cdp sshd[1988423]: Failed password for root from 165.22.101.75 port 36636 ssh2
Sep 14 19:40:41 nativespace-cdp sshd[1988423]: Received disconnect from 165.22.101.75 port 36636:11: Bye Bye [preauth]
Sep 14 19:40:41 nativespace-cdp sshd[1988423]: Disconnected from 165.22.101.75 port 36636 [preauth]
Sep 14 19:41:19 nativespace-cdp sshd[1988667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.124.148  user=root
Sep 14 19:41:19 nativespace-cdp sshd[1988667]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:41:22 nativespace-cdp sshd[1988667]: Failed password for root from 47.236.124.148 port 46916 ssh2
Sep 14 19:41:22 nativespace-cdp sshd[1988667]: Received disconnect from 47.236.124.148 port 46916:11: Bye Bye [preauth]
Sep 14 19:41:22 nativespace-cdp sshd[1988667]: Disconnected from 47.236.124.148 port 46916 [preauth]
Sep 14 19:41:34 nativespace-cdp sshd[1988713]: Connection closed by 159.100.136.21 port 52158 [preauth]
Sep 14 19:41:36 nativespace-cdp sshd[1988715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.48.65.150  user=root
Sep 14 19:41:36 nativespace-cdp sshd[1988715]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:41:37 nativespace-cdp sshd[1988715]: Failed password for root from 181.48.65.150 port 60230 ssh2
Sep 14 19:41:37 nativespace-cdp sshd[1988715]: Received disconnect from 181.48.65.150 port 60230:11: Bye Bye [preauth]
Sep 14 19:41:37 nativespace-cdp sshd[1988715]: Disconnected from 181.48.65.150 port 60230 [preauth]
Sep 14 19:41:41 nativespace-cdp sshd[1988743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.34.106.146  user=root
Sep 14 19:41:41 nativespace-cdp sshd[1988743]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:41:43 nativespace-cdp sshd[1988743]: Failed password for root from 114.34.106.146 port 44150 ssh2
Sep 14 19:41:43 nativespace-cdp sshd[1988743]: Received disconnect from 114.34.106.146 port 44150:11: Bye Bye [preauth]
Sep 14 19:41:43 nativespace-cdp sshd[1988743]: Disconnected from 114.34.106.146 port 44150 [preauth]
Sep 14 19:41:43 nativespace-cdp sshd[1988823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.236.124.148  user=root
Sep 14 19:41:43 nativespace-cdp sshd[1988823]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:41:45 nativespace-cdp sshd[1988823]: Failed password for root from 47.236.124.148 port 39244 ssh2
Sep 14 19:41:47 nativespace-cdp sshd[1988823]: Received disconnect from 47.236.124.148 port 39244:11: Bye Bye [preauth]
Sep 14 19:41:47 nativespace-cdp sshd[1988823]: Disconnected from 47.236.124.148 port 39244 [preauth]
Sep 14 19:42:27 nativespace-cdp sshd[1989299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.34.106.146  user=root
Sep 14 19:42:27 nativespace-cdp sshd[1989299]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:42:28 nativespace-cdp sshd[1989304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.48.65.150  user=root
Sep 14 19:42:28 nativespace-cdp sshd[1989304]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:42:29 nativespace-cdp sshd[1989299]: Failed password for root from 114.34.106.146 port 48244 ssh2
Sep 14 19:42:29 nativespace-cdp sshd[1989299]: Received disconnect from 114.34.106.146 port 48244:11: Bye Bye [preauth]
Sep 14 19:42:29 nativespace-cdp sshd[1989299]: Disconnected from 114.34.106.146 port 48244 [preauth]
Sep 14 19:42:29 nativespace-cdp sshd[1989304]: Failed password for root from 181.48.65.150 port 44910 ssh2
Sep 14 19:42:30 nativespace-cdp sshd[1989304]: Received disconnect from 181.48.65.150 port 44910:11: Bye Bye [preauth]
Sep 14 19:42:30 nativespace-cdp sshd[1989304]: Disconnected from 181.48.65.150 port 44910 [preauth]
Sep 14 19:42:40 nativespace-cdp sshd[1989382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.101.75  user=root
Sep 14 19:42:40 nativespace-cdp sshd[1989382]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:42:41 nativespace-cdp sshd[1989382]: Failed password for root from 165.22.101.75 port 57646 ssh2
Sep 14 19:42:41 nativespace-cdp sshd[1989382]: Received disconnect from 165.22.101.75 port 57646:11: Bye Bye [preauth]
Sep 14 19:42:41 nativespace-cdp sshd[1989382]: Disconnected from 165.22.101.75 port 57646 [preauth]
Sep 14 19:43:40 nativespace-cdp sshd[1989550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.101.75  user=root
Sep 14 19:43:40 nativespace-cdp sshd[1989550]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 19:43:41 nativespace-cdp sshd[1989550]: Failed password for root from 165.22.101.75 port 43520 ssh2
Sep 14 19:43:42 nativespace-cdp sshd[1989550]: Received disconnect from 165.22.101.75 port 43520:11: Bye Bye [preauth]
Sep 14 19:43:42 nativespace-cdp sshd[1989550]: Disconnected from 165.22.101.75 port 43520 [preauth]
Sep 14 19:46:33 nativespace-cdp sshd[1990354]: Connection closed by 159.100.136.21 port 33632 [preauth]
Sep 14 19:51:33 nativespace-cdp sshd[1991457]: Connection closed by 159.100.136.21 port 42932 [preauth]
Sep 14 19:56:40 nativespace-cdp sshd[1992544]: Connection closed by 159.100.136.21 port 52738 [preauth]
Sep 14 20:01:33 nativespace-cdp sshd[1994123]: Connection closed by 159.100.136.21 port 33630 [preauth]
Sep 14 20:06:33 nativespace-cdp sshd[1995237]: Connection closed by 159.100.136.21 port 43448 [preauth]
Sep 14 20:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 20:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:42 nativespace-cdp sudo[1995844]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 20:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:42 nativespace-cdp sudo[1995848]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 20:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:44 nativespace-cdp sudo[1995853]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 20:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:44 nativespace-cdp sudo[1995863]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 20:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:48 nativespace-cdp sudo[1995869]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 20:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:48 nativespace-cdp sudo[1995886]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:49 nativespace-cdp sudo[1995891]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:49 nativespace-cdp sudo[1995895]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:49 nativespace-cdp sudo[1995901]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:49 nativespace-cdp sudo[1995907]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:49 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 20:09:49 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:49 nativespace-cdp sudo[1995912]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 20:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:51 nativespace-cdp sudo[1995929]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 20:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:52 nativespace-cdp sudo[1995936]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=thqkgnbz user-2=connectedshoppin user-3=ianrayne user-4=accooper user-5=fetch user-6=carsinyo user-7=hubmaster user-8=putterfi user-9=elecleis user-10=gilpin user-11=milloyco user-12=highlegh user-13=southlon user-14=firstred user-15=costestimatorco user-16=clarkass user-17=firstrel user-18=coursemc user-19=opaiscyx user-20=firstres user-21=ultbcrra user-22=jonhartl user-23=seftvta user-24=nativene user-25=stuartge user-26=askhform user-27=innovat1 user-28=alexadmin user-29=skyfirec user-30=bemadonn user-31=newstoda user-32=ggaaorgu user-33=belle user-34=bedfords user-35=oneoarco user-36=battlere user-37=vivienn1 user-38=firstre2 user-39=nstriton user-40=brighto1 user-41=leereyn1 user-42=stephani user-43=agproduc user-44=still user-45=theblack user-46=hodgesonweb user-47=spectrum
Sep 14 20:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=jarvisin user-49=ulsukarm user-50=lbscrmod user-51=maflemin user-52=vantagep user-53=athenare user-54=connect9 user-55=booff user-56=foundation user-57=markward user-58=magichat user-59=hhdugcor user-60=lbhyisi user-61=ptkxhsbt user-62=dickemery123 user-63=martsblo user-64=megacards user-65=musorguk user-66=wilsonsw user-67=atestord user-68=sarafoundation user-69=strathar user-70=lakesan1 user-71=brmrjxl user-72=romaldki user-73=branko user-74=outdoorc user-75=ranxterc user-76=hodgsonmail user-77=onlycont user-78=lucy user-79=attlebor user-80=david user-81=nbhavers user-82=careers user-83=mcdermos user-84=chrisdal user-85=jennimil user-86=tomandle user-87=design user-88=kategilpin user-89=stagingerris user-90=dancinggardener user-91=ladburyp user-92=nvihkvu user-93=havantho user-94=sketchy user-95=cath user-96=what user-97=oubpgvbx user-98=tstardom user-99=crrtipdl user-100=sosevalu user-101=bakery
Sep 14 20:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=boldover user-103=nove user-104=dhyana user-105=darkstar user-106=eatspam user-107=beauty user-108=nsceres user-109=fawcettd user-110=burydropin user-111=steve user-112=zebrapho user-113=bwppodcast user-114=asandcoc user-115=sibtoncc user-116=courseme user-117=eugincou user-118=hirefootballgame user-119=cwsocial user-120=howardon user-121=pugwash user-122=paulmca1 user-123=reliable user-124=ninejimm user-125=cambria1 user-126=cathski user-127=barbersh user-128=tigerlet user-129=nomistakes user-130=hidden user-131=isleofwi user-132=smrszyqg user-133=donnychicago user-134=steakbridieme user-135=firstre5 user-136=philmcph user-137=ctedorgu user-138=lkpier user-139=foods user-140=leftie user-141=health2045 user-142=fortunaz user-143=nscdp user-144=putterfc feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 20:09:52 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 20:09:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:53 nativespace-cdp sudo[1995944]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:54 nativespace-cdp sudo[1995956]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oAsAQpFGlXP7J9LW.~
Sep 14 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:54 nativespace-cdp sudo[1995961]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oAsAQpFGlXP7J9LW.~'
Sep 14 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:54 nativespace-cdp sudo[1995965]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-oAsAQpFGlXP7J9LW.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:54 nativespace-cdp sudo[1995971]: pam_unix(sudo:session): session closed for user root
Sep 14 20:09:54 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 20:09:54 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:09:54 nativespace-cdp sudo[1995976]: pam_unix(sudo:session): session closed for user root
Sep 14 20:10:20 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 20:10:20 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 20:10:21 nativespace-cdp sudo[1996186]: pam_unix(sudo:session): session closed for user root
Sep 14 20:11:33 nativespace-cdp sshd[1996514]: Connection closed by 159.100.136.21 port 52744 [preauth]
Sep 14 20:16:33 nativespace-cdp sshd[1997981]: Connection closed by 159.100.136.21 port 33262 [preauth]
Sep 14 20:26:35 nativespace-cdp sshd[2000042]: Connection closed by 159.100.136.21 port 51158 [preauth]
Sep 14 20:26:37 nativespace-cdp sshd[2000046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.75.180  user=root
Sep 14 20:26:37 nativespace-cdp sshd[2000046]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:26:39 nativespace-cdp sshd[2000046]: Failed password for root from 128.199.75.180 port 46046 ssh2
Sep 14 20:26:39 nativespace-cdp sshd[2000046]: Received disconnect from 128.199.75.180 port 46046:11: Bye Bye [preauth]
Sep 14 20:26:39 nativespace-cdp sshd[2000046]: Disconnected from 128.199.75.180 port 46046 [preauth]
Sep 14 20:28:22 nativespace-cdp sshd[2000753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.35  user=root
Sep 14 20:28:22 nativespace-cdp sshd[2000753]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:28:24 nativespace-cdp sshd[2000753]: Failed password for root from 167.71.236.35 port 49152 ssh2
Sep 14 20:28:24 nativespace-cdp sshd[2000753]: Received disconnect from 167.71.236.35 port 49152:11: Bye Bye [preauth]
Sep 14 20:28:24 nativespace-cdp sshd[2000753]: Disconnected from 167.71.236.35 port 49152 [preauth]
Sep 14 20:31:33 nativespace-cdp sshd[2001621]: Connection closed by 159.100.136.21 port 60386 [preauth]
Sep 14 20:31:57 nativespace-cdp sshd[2001707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.245.97.252  user=root
Sep 14 20:31:57 nativespace-cdp sshd[2001707]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:32:00 nativespace-cdp sshd[2001707]: Failed password for root from 47.245.97.252 port 54528 ssh2
Sep 14 20:32:00 nativespace-cdp sshd[2001707]: Received disconnect from 47.245.97.252 port 54528:11: Bye Bye [preauth]
Sep 14 20:32:00 nativespace-cdp sshd[2001707]: Disconnected from 47.245.97.252 port 54528 [preauth]
Sep 14 20:34:01 nativespace-cdp sshd[2002049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.80.45.73  user=root
Sep 14 20:34:01 nativespace-cdp sshd[2002049]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:34:02 nativespace-cdp sshd[2002049]: Failed password for root from 2.80.45.73 port 60632 ssh2
Sep 14 20:34:02 nativespace-cdp sshd[2002049]: Received disconnect from 2.80.45.73 port 60632:11: Bye Bye [preauth]
Sep 14 20:34:02 nativespace-cdp sshd[2002049]: Disconnected from 2.80.45.73 port 60632 [preauth]
Sep 14 20:34:23 nativespace-cdp sshd[2002113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.245.97.252  user=root
Sep 14 20:34:23 nativespace-cdp sshd[2002113]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:34:24 nativespace-cdp sshd[2002113]: Failed password for root from 47.245.97.252 port 34766 ssh2
Sep 14 20:34:25 nativespace-cdp sshd[2002113]: Received disconnect from 47.245.97.252 port 34766:11: Bye Bye [preauth]
Sep 14 20:34:25 nativespace-cdp sshd[2002113]: Disconnected from 47.245.97.252 port 34766 [preauth]
Sep 14 20:34:46 nativespace-cdp sshd[2002171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.245.97.252  user=root
Sep 14 20:34:46 nativespace-cdp sshd[2002171]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:34:48 nativespace-cdp sshd[2002171]: Failed password for root from 47.245.97.252 port 58064 ssh2
Sep 14 20:34:48 nativespace-cdp sshd[2002171]: Received disconnect from 47.245.97.252 port 58064:11: Bye Bye [preauth]
Sep 14 20:34:48 nativespace-cdp sshd[2002171]: Disconnected from 47.245.97.252 port 58064 [preauth]
Sep 14 20:35:02 nativespace-cdp sshd[2002327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.75.180  user=root
Sep 14 20:35:02 nativespace-cdp sshd[2002327]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:35:05 nativespace-cdp sshd[2002327]: Failed password for root from 128.199.75.180 port 57670 ssh2
Sep 14 20:35:08 nativespace-cdp sshd[2002327]: Received disconnect from 128.199.75.180 port 57670:11: Bye Bye [preauth]
Sep 14 20:35:08 nativespace-cdp sshd[2002327]: Disconnected from 128.199.75.180 port 57670 [preauth]
Sep 14 20:35:23 nativespace-cdp sshd[2002409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.35  user=root
Sep 14 20:35:23 nativespace-cdp sshd[2002409]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:35:25 nativespace-cdp sshd[2002409]: Failed password for root from 167.71.236.35 port 60566 ssh2
Sep 14 20:35:26 nativespace-cdp sshd[2002409]: Received disconnect from 167.71.236.35 port 60566:11: Bye Bye [preauth]
Sep 14 20:35:26 nativespace-cdp sshd[2002409]: Disconnected from 167.71.236.35 port 60566 [preauth]
Sep 14 20:35:50 nativespace-cdp sshd[2002519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.75.180  user=root
Sep 14 20:35:50 nativespace-cdp sshd[2002519]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:35:52 nativespace-cdp sshd[2002519]: Failed password for root from 128.199.75.180 port 51786 ssh2
Sep 14 20:36:05 nativespace-cdp sshd[2002597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.35  user=root
Sep 14 20:36:05 nativespace-cdp sshd[2002597]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:36:07 nativespace-cdp sshd[2002597]: Failed password for root from 167.71.236.35 port 51960 ssh2
Sep 14 20:36:35 nativespace-cdp sshd[2002803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.80.45.73  user=root
Sep 14 20:36:35 nativespace-cdp sshd[2002803]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:36:35 nativespace-cdp sshd[2002807]: Connection closed by 159.100.136.21 port 41992 [preauth]
Sep 14 20:36:37 nativespace-cdp sshd[2002803]: Failed password for root from 2.80.45.73 port 50860 ssh2
Sep 14 20:36:37 nativespace-cdp sshd[2002803]: Received disconnect from 2.80.45.73 port 50860:11: Bye Bye [preauth]
Sep 14 20:36:37 nativespace-cdp sshd[2002803]: Disconnected from 2.80.45.73 port 50860 [preauth]
Sep 14 20:37:25 nativespace-cdp sshd[2002971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.80.45.73  user=root
Sep 14 20:37:25 nativespace-cdp sshd[2002971]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 20:37:27 nativespace-cdp sshd[2002971]: Failed password for root from 2.80.45.73 port 64625 ssh2
Sep 14 20:41:33 nativespace-cdp sshd[2003876]: Connection closed by 159.100.136.21 port 51060 [preauth]
Sep 14 20:46:33 nativespace-cdp sshd[2005484]: Connection closed by 159.100.136.21 port 60706 [preauth]
Sep 14 20:51:33 nativespace-cdp sshd[2006497]: Connection closed by 159.100.136.21 port 41576 [preauth]
Sep 14 20:56:33 nativespace-cdp sshd[2007472]: Connection closed by 159.100.136.21 port 50182 [preauth]
Sep 14 21:01:37 nativespace-cdp sshd[2008944]: Connection closed by 159.100.136.21 port 59358 [preauth]
Sep 14 21:06:34 nativespace-cdp sshd[2010057]: Connection closed by 159.100.136.21 port 38500 [preauth]
Sep 14 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:43 nativespace-cdp sudo[2010659]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:43 nativespace-cdp sudo[2010664]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:43 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 21:09:43 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:44 nativespace-cdp sudo[2010669]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:44 nativespace-cdp sudo[2010676]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:44 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 21:09:44 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:48 nativespace-cdp sudo[2010682]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 21:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:48 nativespace-cdp sudo[2010697]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 21:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:48 nativespace-cdp sudo[2010702]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 21:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:48 nativespace-cdp sudo[2010707]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 21:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:48 nativespace-cdp sudo[2010712]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 21:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:48 nativespace-cdp sudo[2010717]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:48 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 21:09:48 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:48 nativespace-cdp sudo[2010724]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 21:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:50 nativespace-cdp sudo[2010734]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 21:09:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:51 nativespace-cdp sudo[2010741]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:51 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bakery user-2=crrtipdl user-3=sosevalu user-4=boldover user-5=nove user-6=design user-7=stagingerris user-8=dancinggardener user-9=ladburyp user-10=kategilpin user-11=havantho user-12=cath user-13=sketchy user-14=nvihkvu user-15=oubpgvbx user-16=tstardom user-17=what user-18=david user-19=careers user-20=nbhavers user-21=chrisdal user-22=mcdermos user-23=jennimil user-24=tomandle user-25=romaldki user-26=hodgsonmail user-27=outdoorc user-28=ranxterc user-29=branko user-30=onlycont user-31=lucy user-32=attlebor user-33=nomistakes user-34=hidden user-35=tigerlet user-36=barbersh user-37=smrszyqg user-38=isleofwi user-39=lkpier user-40=firstre5 user-41=donnychicago user-42=steakbridieme user-43=philmcph user-44=ctedorgu user-45=nscdp user-46=putterfc user-47=foods user-48=leftie user-49=health2045
Sep 14 21:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=fortunaz user-51=eugincou user-52=courseme user-53=hirefootballgame user-54=cwsocial user-55=paulmca1 user-56=howardon user-57=pugwash user-58=cathski user-59=cambria1 user-60=reliable user-61=ninejimm user-62=steve user-63=bwppodcast user-64=zebrapho user-65=asandcoc user-66=sibtoncc user-67=dhyana user-68=beauty user-69=darkstar user-70=eatspam user-71=nsceres user-72=fawcettd user-73=burydropin user-74=newstoda user-75=ggaaorgu user-76=belle user-77=bemadonn user-78=bedfords user-79=vivienn1 user-80=firstre2 user-81=oneoarco user-82=battlere user-83=nstriton user-84=brighto1 user-85=nativene user-86=innovat1 user-87=stuartge user-88=askhform user-89=skyfirec user-90=alexadmin user-91=firstred user-92=highlegh user-93=southlon user-94=firstrel user-95=clarkass user-96=costestimatorco user-97=opaiscyx user-98=coursemc user-99=ultbcrra user-100=jonhartl user-101=seftvta user-102=firstres
Sep 14 21:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=connectedshoppin user-104=thqkgnbz user-105=accooper user-106=ianrayne user-107=hubmaster user-108=putterfi user-109=fetch user-110=carsinyo user-111=gilpin user-112=milloyco user-113=elecleis user-114=megacards user-115=musorguk user-116=wilsonsw user-117=strathar user-118=atestord user-119=sarafoundation user-120=lakesan1 user-121=brmrjxl user-122=magichat user-123=hhdugcor user-124=lbhyisi user-125=dickemery123 user-126=ptkxhsbt user-127=martsblo user-128=ulsukarm user-129=vantagep user-130=athenare user-131=connect9 user-132=lbscrmod user-133=maflemin user-134=foundation user-135=booff user-136=markward user-137=stephani user-138=leereyn1 user-139=agproduc user-140=still user-141=spectrum user-142=theblack user-143=hodgesonweb user-144=jarvisin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 21:09:51 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 21:09:51 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:52 nativespace-cdp sudo[2010749]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 21:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:53 nativespace-cdp sudo[2010764]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-THOqfN72CRlKWe11.~
Sep 14 21:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:53 nativespace-cdp sudo[2010769]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-THOqfN72CRlKWe11.~'
Sep 14 21:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:53 nativespace-cdp sudo[2010773]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-THOqfN72CRlKWe11.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 21:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:53 nativespace-cdp sudo[2010780]: pam_unix(sudo:session): session closed for user root
Sep 14 21:09:53 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 21:09:53 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:09:53 nativespace-cdp sudo[2010785]: pam_unix(sudo:session): session closed for user root
Sep 14 21:10:00 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 21:10:00 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 21:10:00 nativespace-cdp sudo[2010815]: pam_unix(sudo:session): session closed for user root
Sep 14 21:11:33 nativespace-cdp sshd[2011327]: Connection closed by 159.100.136.21 port 47050 [preauth]
Sep 14 21:16:34 nativespace-cdp sshd[2013010]: Connection closed by 159.100.136.21 port 55346 [preauth]
Sep 14 21:21:34 nativespace-cdp sshd[2014133]: Connection closed by 159.100.136.21 port 35094 [preauth]
Sep 14 21:26:35 nativespace-cdp sshd[2015191]: Connection closed by 159.100.136.21 port 44016 [preauth]
Sep 14 21:31:36 nativespace-cdp sshd[2016484]: Connection closed by 159.100.136.21 port 53544 [preauth]
Sep 14 21:35:10 nativespace-cdp sshd[2017350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.74.5.177  user=root
Sep 14 21:35:10 nativespace-cdp sshd[2017350]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 21:35:13 nativespace-cdp sshd[2017350]: Failed password for root from 185.74.5.177 port 48086 ssh2
Sep 14 21:35:13 nativespace-cdp sshd[2017350]: Received disconnect from 185.74.5.177 port 48086:11: Bye Bye [preauth]
Sep 14 21:35:13 nativespace-cdp sshd[2017350]: Disconnected from 185.74.5.177 port 48086 [preauth]
Sep 14 21:36:15 nativespace-cdp sshd[2017759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.67.7.178  user=root
Sep 14 21:36:15 nativespace-cdp sshd[2017759]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 21:36:17 nativespace-cdp sshd[2017759]: Failed password for root from 82.67.7.178 port 43486 ssh2
Sep 14 21:36:18 nativespace-cdp sshd[2017759]: Received disconnect from 82.67.7.178 port 43486:11: Bye Bye [preauth]
Sep 14 21:36:18 nativespace-cdp sshd[2017759]: Disconnected from 82.67.7.178 port 43486 [preauth]
Sep 14 21:36:36 nativespace-cdp sshd[2017814]: Connection closed by 159.100.136.21 port 59226 [preauth]
Sep 14 21:37:24 nativespace-cdp sshd[2018039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.196.50.91  user=root
Sep 14 21:37:24 nativespace-cdp sshd[2018039]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 21:37:26 nativespace-cdp sshd[2018039]: Failed password for root from 200.196.50.91 port 58648 ssh2
Sep 14 21:37:26 nativespace-cdp sshd[2018039]: Received disconnect from 200.196.50.91 port 58648:11: Bye Bye [preauth]
Sep 14 21:37:26 nativespace-cdp sshd[2018039]: Disconnected from 200.196.50.91 port 58648 [preauth]
Sep 14 21:38:38 nativespace-cdp sshd[2018200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.67.7.178  user=root
Sep 14 21:38:38 nativespace-cdp sshd[2018200]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 21:38:41 nativespace-cdp sshd[2018200]: Failed password for root from 82.67.7.178 port 56596 ssh2
Sep 14 21:38:41 nativespace-cdp sshd[2018200]: Received disconnect from 82.67.7.178 port 56596:11: Bye Bye [preauth]
Sep 14 21:38:41 nativespace-cdp sshd[2018200]: Disconnected from 82.67.7.178 port 56596 [preauth]
Sep 14 21:39:16 nativespace-cdp sshd[2018322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.67.7.178  user=root
Sep 14 21:39:16 nativespace-cdp sshd[2018322]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 21:39:18 nativespace-cdp sshd[2018322]: Failed password for root from 82.67.7.178 port 51420 ssh2
Sep 14 21:39:18 nativespace-cdp sshd[2018322]: Received disconnect from 82.67.7.178 port 51420:11: Bye Bye [preauth]
Sep 14 21:39:18 nativespace-cdp sshd[2018322]: Disconnected from 82.67.7.178 port 51420 [preauth]
Sep 14 21:39:34 nativespace-cdp sshd[2018386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.196.50.91  user=root
Sep 14 21:39:34 nativespace-cdp sshd[2018386]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 21:39:36 nativespace-cdp sshd[2018386]: Failed password for root from 200.196.50.91 port 41265 ssh2
Sep 14 21:39:36 nativespace-cdp sshd[2018386]: Received disconnect from 200.196.50.91 port 41265:11: Bye Bye [preauth]
Sep 14 21:39:36 nativespace-cdp sshd[2018386]: Disconnected from 200.196.50.91 port 41265 [preauth]
Sep 14 21:39:41 nativespace-cdp sshd[2018407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.74.5.177  user=root
Sep 14 21:39:41 nativespace-cdp sshd[2018407]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 21:39:43 nativespace-cdp sshd[2018407]: Failed password for root from 185.74.5.177 port 54540 ssh2
Sep 14 21:39:45 nativespace-cdp sshd[2018407]: Received disconnect from 185.74.5.177 port 54540:11: Bye Bye [preauth]
Sep 14 21:39:45 nativespace-cdp sshd[2018407]: Disconnected from 185.74.5.177 port 54540 [preauth]
Sep 14 21:40:33 nativespace-cdp sshd[2018672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.74.5.177  user=root
Sep 14 21:40:33 nativespace-cdp sshd[2018672]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 21:40:36 nativespace-cdp sshd[2018672]: Failed password for root from 185.74.5.177 port 39034 ssh2
Sep 14 21:40:39 nativespace-cdp sshd[2018672]: Received disconnect from 185.74.5.177 port 39034:11: Bye Bye [preauth]
Sep 14 21:40:39 nativespace-cdp sshd[2018672]: Disconnected from 185.74.5.177 port 39034 [preauth]
Sep 14 21:40:49 nativespace-cdp sshd[2018666]: Connection closed by 200.196.50.91 port 47639 [preauth]
Sep 14 21:41:19 nativespace-cdp sshd[2019011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.196.50.91  user=root
Sep 14 21:41:19 nativespace-cdp sshd[2019011]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 21:41:21 nativespace-cdp sshd[2019011]: Failed password for root from 200.196.50.91 port 54016 ssh2
Sep 14 21:41:33 nativespace-cdp sshd[2019074]: Connection closed by 159.100.136.21 port 40230 [preauth]
Sep 14 21:46:35 nativespace-cdp sshd[2020298]: Connection closed by 159.100.136.21 port 49662 [preauth]
Sep 14 21:51:33 nativespace-cdp sshd[2021601]: Connection closed by 159.100.136.21 port 58460 [preauth]
Sep 14 21:56:33 nativespace-cdp sshd[2022694]: Connection closed by 159.100.136.21 port 39186 [preauth]
Sep 14 22:01:33 nativespace-cdp sshd[2024451]: Connection closed by 159.100.136.21 port 48340 [preauth]
Sep 14 22:06:33 nativespace-cdp sshd[2025611]: Connection closed by 159.100.136.21 port 58256 [preauth]
Sep 14 22:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 22:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:37 nativespace-cdp sudo[2026330]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 22:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:37 nativespace-cdp sudo[2026334]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 22:09:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:38 nativespace-cdp sudo[2026337]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:38 nativespace-cdp sudo[2026345]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:38 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 22:09:38 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:42 nativespace-cdp sudo[2026348]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 22:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:42 nativespace-cdp sudo[2026393]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 22:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:42 nativespace-cdp sudo[2026396]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 22:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:42 nativespace-cdp sudo[2026399]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 22:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:42 nativespace-cdp sudo[2026402]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 22:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:42 nativespace-cdp sudo[2026405]: pam_unix(sudo:session): session closed for user root
Sep 14 22:09:42 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 22:09:42 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:09:42 nativespace-cdp sudo[2026408]: pam_unix(sudo:session): session closed for user root
Sep 14 22:10:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 22:10:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:10:10 nativespace-cdp sudo[2026727]: pam_unix(sudo:session): session closed for user root
Sep 14 22:10:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 22:10:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:10:12 nativespace-cdp sudo[2026740]: pam_unix(sudo:session): session closed for user root
Sep 14 22:10:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=hirefootballgame user-2=eugincou user-3=courseme user-4=cambria1 user-5=cathski user-6=reliable user-7=ninejimm user-8=cwsocial user-9=pugwash user-10=paulmca1 user-11=howardon user-12=isleofwi user-13=smrszyqg user-14=nomistakes user-15=hidden user-16=tigerlet user-17=barbersh user-18=nscdp user-19=putterfc user-20=leftie user-21=foods user-22=fortunaz user-23=health2045 user-24=lkpier user-25=donnychicago user-26=steakbridieme user-27=firstre5 user-28=ctedorgu user-29=philmcph user-30=beauty user-31=darkstar user-32=eatspam user-33=dhyana user-34=fawcettd user-35=burydropin user-36=nsceres user-37=bwppodcast user-38=zebrapho user-39=steve user-40=asandcoc user-41=sibtoncc user-42=stagingerris user-43=dancinggardener user-44=ladburyp user-45=kategilpin user-46=design user-47=oubpgvbx
Sep 14 22:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=tstardom user-49=what user-50=havantho user-51=cath user-52=sketchy user-53=nvihkvu user-54=bakery user-55=crrtipdl user-56=sosevalu user-57=nove user-58=boldover user-59=ranxterc user-60=outdoorc user-61=hodgsonmail user-62=branko user-63=romaldki user-64=lucy user-65=attlebor user-66=onlycont user-67=chrisdal user-68=mcdermos user-69=david user-70=nbhavers user-71=careers user-72=tomandle user-73=jennimil user-74=hhdugcor user-75=lbhyisi user-76=magichat user-77=martsblo user-78=dickemery123 user-79=ptkxhsbt user-80=wilsonsw user-81=megacards user-82=musorguk user-83=brmrjxl user-84=lakesan1 user-85=strathar user-86=atestord user-87=sarafoundation user-88=agproduc user-89=still user-90=stephani user-91=leereyn1 user-92=jarvisin user-93=spectrum user-94=theblack user-95=hodgesonweb user-96=ulsukarm user-97=booff user-98=foundation user-99=markward user-100=vantagep user-101=connect9 user-102=athenare
Sep 14 22:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=lbscrmod user-104=maflemin user-105=innovat1 user-106=askhform user-107=stuartge user-108=nativene user-109=skyfirec user-110=alexadmin user-111=bedfords user-112=newstoda user-113=belle user-114=ggaaorgu user-115=bemadonn user-116=nstriton user-117=brighto1 user-118=vivienn1 user-119=firstre2 user-120=oneoarco user-121=battlere user-122=accooper user-123=ianrayne user-124=connectedshoppin user-125=thqkgnbz user-126=gilpin user-127=milloyco user-128=elecleis user-129=hubmaster user-130=putterfi user-131=fetch user-132=carsinyo user-133=clarkass user-134=firstrel user-135=costestimatorco user-136=firstred user-137=highlegh user-138=southlon user-139=ultbcrra user-140=jonhartl user-141=seftvta user-142=firstres user-143=coursemc user-144=opaiscyx feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 22:10:13 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 22:10:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:12:28 nativespace-cdp sshd[2027033]: Did not receive identification string from 159.100.136.21 port 39066
Sep 14 22:12:41 nativespace-cdp sudo[2026776]: pam_unix(sudo:session): session closed for user root
Sep 14 22:12:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 22:12:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:12:50 nativespace-cdp sudo[2027339]: pam_unix(sudo:session): session closed for user root
Sep 14 22:12:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Mci3I1LNyhSTqrfG.~
Sep 14 22:12:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:12:50 nativespace-cdp sudo[2027383]: pam_unix(sudo:session): session closed for user root
Sep 14 22:12:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Mci3I1LNyhSTqrfG.~'
Sep 14 22:12:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:12:50 nativespace-cdp sudo[2027386]: pam_unix(sudo:session): session closed for user root
Sep 14 22:12:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-Mci3I1LNyhSTqrfG.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 22:12:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:12:50 nativespace-cdp sudo[2027392]: pam_unix(sudo:session): session closed for user root
Sep 14 22:12:50 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 22:12:50 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:12:50 nativespace-cdp sudo[2027400]: pam_unix(sudo:session): session closed for user root
Sep 14 22:12:52 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_licenses --output=json
Sep 14 22:12:52 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:12:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 22:12:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:12:55 nativespace-cdp sudo[2027443]: pam_unix(sudo:session): session closed for user root
Sep 14 22:12:55 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status chrisdal
Sep 14 22:12:55 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:12:56 nativespace-cdp sudo[2027421]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 22:13:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:13:09 nativespace-cdp sudo[2027607]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:15 nativespace-cdp sudo[2027456]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 22:13:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:13:29 nativespace-cdp sudo[2027716]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status chrisdal
Sep 14 22:13:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:13:30 nativespace-cdp sudo[2027721]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:34 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 22:13:34 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:13:35 nativespace-cdp sudo[2027745]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:35 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status chrisdal
Sep 14 22:13:35 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:13:35 nativespace-cdp sudo[2027749]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 22:13:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:13:37 nativespace-cdp sudo[2027767]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:37 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status chrisdal
Sep 14 22:13:37 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:13:38 nativespace-cdp sudo[2027772]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 22:13:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:13:39 nativespace-cdp sudo[2027792]: pam_unix(sudo:session): session closed for user root
Sep 14 22:13:39 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --user-status elecleis
Sep 14 22:13:39 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 22:13:40 nativespace-cdp sudo[2027796]: pam_unix(sudo:session): session closed for user root
Sep 14 22:16:35 nativespace-cdp sshd[2028480]: Connection closed by 159.100.136.21 port 48562 [preauth]
Sep 14 22:21:34 nativespace-cdp sshd[2029802]: Connection closed by 159.100.136.21 port 58002 [preauth]
Sep 14 22:26:33 nativespace-cdp sshd[2030819]: Connection closed by 159.100.136.21 port 39580 [preauth]
Sep 14 22:31:33 nativespace-cdp sshd[2032434]: Connection closed by 159.100.136.21 port 48620 [preauth]
Sep 14 22:36:34 nativespace-cdp sshd[2033538]: Connection closed by 159.100.136.21 port 58292 [preauth]
Sep 14 22:41:34 nativespace-cdp sshd[2034635]: Connection closed by 159.100.136.21 port 39150 [preauth]
Sep 14 22:46:34 nativespace-cdp sshd[2036298]: Connection closed by 159.100.136.21 port 48850 [preauth]
Sep 14 22:51:34 nativespace-cdp sshd[2037568]: Connection closed by 159.100.136.21 port 58358 [preauth]
Sep 14 22:56:33 nativespace-cdp sshd[2038704]: Connection closed by 159.100.136.21 port 39910 [preauth]
Sep 14 23:01:33 nativespace-cdp sshd[2040229]: Connection closed by 159.100.136.21 port 49402 [preauth]
Sep 14 23:06:36 nativespace-cdp sshd[2041302]: Connection closed by 159.100.136.21 port 58522 [preauth]
Sep 14 23:06:55 nativespace-cdp sshd[2041351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.31.118.11  user=root
Sep 14 23:06:55 nativespace-cdp sshd[2041351]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:06:57 nativespace-cdp sshd[2041351]: Failed password for root from 103.31.118.11 port 39082 ssh2
Sep 14 23:06:58 nativespace-cdp sshd[2041351]: Received disconnect from 103.31.118.11 port 39082:11: Bye Bye [preauth]
Sep 14 23:06:58 nativespace-cdp sshd[2041351]: Disconnected from 103.31.118.11 port 39082 [preauth]
Sep 14 23:07:23 nativespace-cdp sshd[2041437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.193.137.88  user=root
Sep 14 23:07:23 nativespace-cdp sshd[2041437]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:07:25 nativespace-cdp sshd[2041437]: Failed password for root from 35.193.137.88 port 60668 ssh2
Sep 14 23:07:25 nativespace-cdp sshd[2041437]: Received disconnect from 35.193.137.88 port 60668:11: Bye Bye [preauth]
Sep 14 23:07:25 nativespace-cdp sshd[2041437]: Disconnected from 35.193.137.88 port 60668 [preauth]
Sep 14 23:07:28 nativespace-cdp sshd[2041448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220  user=root
Sep 14 23:07:28 nativespace-cdp sshd[2041448]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:07:30 nativespace-cdp sshd[2041448]: Failed password for root from 122.54.18.220 port 14176 ssh2
Sep 14 23:07:30 nativespace-cdp sshd[2041448]: Received disconnect from 122.54.18.220 port 14176:11: Bye Bye [preauth]
Sep 14 23:07:30 nativespace-cdp sshd[2041448]: Disconnected from 122.54.18.220 port 14176 [preauth]
Sep 14 23:07:46 nativespace-cdp sshd[2041493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.198.176  user=root
Sep 14 23:07:46 nativespace-cdp sshd[2041493]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:07:47 nativespace-cdp sshd[2041493]: Failed password for root from 34.92.198.176 port 45174 ssh2
Sep 14 23:07:52 nativespace-cdp sshd[2041493]: Received disconnect from 34.92.198.176 port 45174:11: Bye Bye [preauth]
Sep 14 23:07:52 nativespace-cdp sshd[2041493]: Disconnected from 34.92.198.176 port 45174 [preauth]
Sep 14 23:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 14 23:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:06 nativespace-cdp sudo[2041811]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 14 23:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:06 nativespace-cdp sudo[2041815]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 14 23:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:07 nativespace-cdp sudo[2041820]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 14 23:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:07 nativespace-cdp sudo[2041827]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 14 23:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:10 nativespace-cdp sudo[2041834]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 14 23:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:10 nativespace-cdp sudo[2041851]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 14 23:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:10 nativespace-cdp sudo[2041856]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 14 23:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:10 nativespace-cdp sudo[2041860]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 14 23:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:10 nativespace-cdp sudo[2041865]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 14 23:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:10 nativespace-cdp sudo[2041871]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 14 23:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:10 nativespace-cdp sudo[2041877]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 14 23:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:12 nativespace-cdp sudo[2041892]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 14 23:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:12 nativespace-cdp sudo[2041898]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=cwsocial user-2=howardon user-3=pugwash user-4=paulmca1 user-5=cathski user-6=cambria1 user-7=reliable user-8=ninejimm user-9=eugincou user-10=courseme user-11=hirefootballgame user-12=lkpier user-13=firstre5 user-14=donnychicago user-15=steakbridieme user-16=ctedorgu user-17=philmcph user-18=nscdp user-19=putterfc user-20=foods user-21=leftie user-22=fortunaz user-23=health2045 user-24=nomistakes user-25=hidden user-26=barbersh user-27=tigerlet user-28=smrszyqg user-29=isleofwi user-30=nsceres user-31=fawcettd user-32=burydropin user-33=dhyana user-34=beauty user-35=darkstar user-36=eatspam user-37=sibtoncc user-38=asandcoc user-39=steve user-40=bwppodcast user-41=zebrapho user-42=havantho user-43=sketchy user-44=cath user-45=nvihkvu user-46=tstardom user-47=oubpgvbx user-48=what user-49=design
Sep 14 23:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-50=dancinggardener user-51=stagingerris user-52=ladburyp user-53=kategilpin user-54=boldover user-55=nove user-56=bakery user-57=crrtipdl user-58=sosevalu user-59=onlycont user-60=lucy user-61=attlebor user-62=romaldki user-63=outdoorc user-64=ranxterc user-65=hodgsonmail user-66=branko user-67=jennimil user-68=tomandle user-69=david user-70=careers user-71=nbhavers user-72=chrisdal user-73=mcdermos user-74=dickemery123 user-75=ptkxhsbt user-76=martsblo user-77=magichat user-78=hhdugcor user-79=lbhyisi user-80=strathar user-81=atestord user-82=sarafoundation user-83=lakesan1 user-84=brmrjxl user-85=megacards user-86=musorguk user-87=wilsonsw user-88=spectrum user-89=theblack user-90=hodgesonweb user-91=jarvisin user-92=stephani user-93=leereyn1 user-94=agproduc user-95=still user-96=vantagep user-97=connect9 user-98=athenare user-99=lbscrmod user-100=maflemin user-101=markward user-102=booff
Sep 14 23:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=foundation user-104=ulsukarm user-105=alexadmin user-106=skyfirec user-107=nativene user-108=innovat1 user-109=stuartge user-110=askhform user-111=vivienn1 user-112=firstre2 user-113=oneoarco user-114=battlere user-115=nstriton user-116=brighto1 user-117=newstoda user-118=belle user-119=ggaaorgu user-120=bemadonn user-121=bedfords user-122=hubmaster user-123=putterfi user-124=fetch user-125=carsinyo user-126=milloyco user-127=gilpin user-128=elecleis user-129=connectedshoppin user-130=thqkgnbz user-131=accooper user-132=ianrayne user-133=coursemc user-134=opaiscyx user-135=ultbcrra user-136=seftvta user-137=jonhartl user-138=firstres user-139=firstred user-140=highlegh user-141=southlon user-142=firstrel user-143=clarkass user-144=costestimatorco feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 14 23:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 14 23:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:13 nativespace-cdp sudo[2041906]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 23:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:14 nativespace-cdp sudo[2041915]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8E5ZabBwk8VfNLlK.~
Sep 14 23:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:14 nativespace-cdp sudo[2041921]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8E5ZabBwk8VfNLlK.~'
Sep 14 23:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:14 nativespace-cdp sudo[2041925]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-8E5ZabBwk8VfNLlK.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 14 23:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:14 nativespace-cdp sudo[2041931]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 14 23:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:14 nativespace-cdp sudo[2041937]: pam_unix(sudo:session): session closed for user root
Sep 14 23:09:29 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 14 23:09:29 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 14 23:09:29 nativespace-cdp sudo[2042000]: pam_unix(sudo:session): session closed for user root
Sep 14 23:10:16 nativespace-cdp sshd[2042228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.42.160  user=root
Sep 14 23:10:16 nativespace-cdp sshd[2042228]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:10:17 nativespace-cdp sshd[2042228]: Failed password for root from 72.167.42.160 port 41612 ssh2
Sep 14 23:10:18 nativespace-cdp sshd[2042228]: Received disconnect from 72.167.42.160 port 41612:11: Bye Bye [preauth]
Sep 14 23:10:18 nativespace-cdp sshd[2042228]: Disconnected from 72.167.42.160 port 41612 [preauth]
Sep 14 23:11:12 nativespace-cdp sshd[2042406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.247.119  user=root
Sep 14 23:11:12 nativespace-cdp sshd[2042406]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:11:13 nativespace-cdp sshd[2042406]: Failed password for root from 34.92.247.119 port 51246 ssh2
Sep 14 23:11:13 nativespace-cdp sshd[2042406]: Received disconnect from 34.92.247.119 port 51246:11: Bye Bye [preauth]
Sep 14 23:11:13 nativespace-cdp sshd[2042406]: Disconnected from 34.92.247.119 port 51246 [preauth]
Sep 14 23:11:17 nativespace-cdp sshd[2042440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.126.105  user=root
Sep 14 23:11:17 nativespace-cdp sshd[2042440]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:11:19 nativespace-cdp sshd[2042440]: Failed password for root from 51.38.126.105 port 60598 ssh2
Sep 14 23:11:27 nativespace-cdp sshd[2042440]: Received disconnect from 51.38.126.105 port 60598:11: Bye Bye [preauth]
Sep 14 23:11:27 nativespace-cdp sshd[2042440]: Disconnected from 51.38.126.105 port 60598 [preauth]
Sep 14 23:11:33 nativespace-cdp sshd[2042508]: Connection closed by 159.100.136.21 port 39590 [preauth]
Sep 14 23:11:38 nativespace-cdp sshd[2042522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.72.191  user=root
Sep 14 23:11:38 nativespace-cdp sshd[2042522]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:11:40 nativespace-cdp sshd[2042522]: Failed password for root from 174.138.72.191 port 51272 ssh2
Sep 14 23:11:42 nativespace-cdp sshd[2042522]: Received disconnect from 174.138.72.191 port 51272:11: Bye Bye [preauth]
Sep 14 23:11:42 nativespace-cdp sshd[2042522]: Disconnected from 174.138.72.191 port 51272 [preauth]
Sep 14 23:11:56 nativespace-cdp sshd[2042581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.127.25  user=root
Sep 14 23:11:56 nativespace-cdp sshd[2042581]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:11:58 nativespace-cdp sshd[2042581]: Failed password for root from 146.59.127.25 port 45224 ssh2
Sep 14 23:11:58 nativespace-cdp sshd[2042581]: Received disconnect from 146.59.127.25 port 45224:11: Bye Bye [preauth]
Sep 14 23:11:58 nativespace-cdp sshd[2042581]: Disconnected from 146.59.127.25 port 45224 [preauth]
Sep 14 23:12:51 nativespace-cdp sshd[2042731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.243.26.124  user=root
Sep 14 23:12:51 nativespace-cdp sshd[2042731]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:12:53 nativespace-cdp sshd[2042731]: Failed password for root from 47.243.26.124 port 39338 ssh2
Sep 14 23:12:58 nativespace-cdp sshd[2042731]: Received disconnect from 47.243.26.124 port 39338:11: Bye Bye [preauth]
Sep 14 23:12:58 nativespace-cdp sshd[2042731]: Disconnected from 47.243.26.124 port 39338 [preauth]
Sep 14 23:13:33 nativespace-cdp sshd[2042971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.215.26  user=root
Sep 14 23:13:33 nativespace-cdp sshd[2042971]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:13:34 nativespace-cdp sshd[2042971]: Failed password for root from 51.77.215.26 port 53076 ssh2
Sep 14 23:13:38 nativespace-cdp sshd[2042971]: Received disconnect from 51.77.215.26 port 53076:11: Bye Bye [preauth]
Sep 14 23:13:38 nativespace-cdp sshd[2042971]: Disconnected from 51.77.215.26 port 53076 [preauth]
Sep 14 23:13:40 nativespace-cdp sshd[2042992]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.58.123.125  user=root
Sep 14 23:13:40 nativespace-cdp sshd[2042992]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:13:42 nativespace-cdp sshd[2042992]: Failed password for root from 198.58.123.125 port 37034 ssh2
Sep 14 23:13:42 nativespace-cdp sshd[2042992]: Received disconnect from 198.58.123.125 port 37034:11: Bye Bye [preauth]
Sep 14 23:13:42 nativespace-cdp sshd[2042992]: Disconnected from 198.58.123.125 port 37034 [preauth]
Sep 14 23:14:28 nativespace-cdp sshd[2043437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.42.160  user=root
Sep 14 23:14:28 nativespace-cdp sshd[2043437]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:14:30 nativespace-cdp sshd[2043437]: Failed password for root from 72.167.42.160 port 49588 ssh2
Sep 14 23:14:30 nativespace-cdp sshd[2043437]: Received disconnect from 72.167.42.160 port 49588:11: Bye Bye [preauth]
Sep 14 23:14:30 nativespace-cdp sshd[2043437]: Disconnected from 72.167.42.160 port 49588 [preauth]
Sep 14 23:14:38 nativespace-cdp sshd[2043447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220  user=root
Sep 14 23:14:38 nativespace-cdp sshd[2043447]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:14:40 nativespace-cdp sshd[2043447]: Failed password for root from 122.54.18.220 port 46676 ssh2
Sep 14 23:14:40 nativespace-cdp sshd[2043447]: Received disconnect from 122.54.18.220 port 46676:11: Bye Bye [preauth]
Sep 14 23:14:40 nativespace-cdp sshd[2043447]: Disconnected from 122.54.18.220 port 46676 [preauth]
Sep 14 23:14:41 nativespace-cdp sshd[2043471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.193.137.88  user=root
Sep 14 23:14:41 nativespace-cdp sshd[2043471]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:14:43 nativespace-cdp sshd[2043471]: Failed password for root from 35.193.137.88 port 45672 ssh2
Sep 14 23:14:46 nativespace-cdp sshd[2043471]: Received disconnect from 35.193.137.88 port 45672:11: Bye Bye [preauth]
Sep 14 23:14:46 nativespace-cdp sshd[2043471]: Disconnected from 35.193.137.88 port 45672 [preauth]
Sep 14 23:14:49 nativespace-cdp sshd[2043491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.31.118.11  user=root
Sep 14 23:14:49 nativespace-cdp sshd[2043491]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:14:51 nativespace-cdp sshd[2043491]: Failed password for root from 103.31.118.11 port 39358 ssh2
Sep 14 23:14:51 nativespace-cdp sshd[2043491]: Received disconnect from 103.31.118.11 port 39358:11: Bye Bye [preauth]
Sep 14 23:14:51 nativespace-cdp sshd[2043491]: Disconnected from 103.31.118.11 port 39358 [preauth]
Sep 14 23:14:52 nativespace-cdp sshd[2043499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.127.25  user=root
Sep 14 23:14:52 nativespace-cdp sshd[2043499]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:14:54 nativespace-cdp sshd[2043499]: Failed password for root from 146.59.127.25 port 54430 ssh2
Sep 14 23:14:54 nativespace-cdp sshd[2043499]: Received disconnect from 146.59.127.25 port 54430:11: Bye Bye [preauth]
Sep 14 23:14:54 nativespace-cdp sshd[2043499]: Disconnected from 146.59.127.25 port 54430 [preauth]
Sep 14 23:14:55 nativespace-cdp sshd[2043505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.126.105  user=root
Sep 14 23:14:55 nativespace-cdp sshd[2043505]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:14:57 nativespace-cdp sshd[2043505]: Failed password for root from 51.38.126.105 port 58262 ssh2
Sep 14 23:15:01 nativespace-cdp sshd[2043505]: Received disconnect from 51.38.126.105 port 58262:11: Bye Bye [preauth]
Sep 14 23:15:01 nativespace-cdp sshd[2043505]: Disconnected from 51.38.126.105 port 58262 [preauth]
Sep 14 23:15:05 nativespace-cdp sshd[2043656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.243.26.124  user=root
Sep 14 23:15:05 nativespace-cdp sshd[2043656]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:07 nativespace-cdp sshd[2043656]: Failed password for root from 47.243.26.124 port 34214 ssh2
Sep 14 23:15:10 nativespace-cdp sshd[2043656]: Received disconnect from 47.243.26.124 port 34214:11: Bye Bye [preauth]
Sep 14 23:15:10 nativespace-cdp sshd[2043656]: Disconnected from 47.243.26.124 port 34214 [preauth]
Sep 14 23:15:13 nativespace-cdp sshd[2043672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.247.119  user=root
Sep 14 23:15:13 nativespace-cdp sshd[2043672]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:15 nativespace-cdp sshd[2043687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.198.176  user=root
Sep 14 23:15:15 nativespace-cdp sshd[2043687]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:15 nativespace-cdp sshd[2043690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.42.160  user=root
Sep 14 23:15:15 nativespace-cdp sshd[2043690]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:15 nativespace-cdp sshd[2043672]: Failed password for root from 34.92.247.119 port 56014 ssh2
Sep 14 23:15:15 nativespace-cdp sshd[2043672]: Received disconnect from 34.92.247.119 port 56014:11: Bye Bye [preauth]
Sep 14 23:15:15 nativespace-cdp sshd[2043672]: Disconnected from 34.92.247.119 port 56014 [preauth]
Sep 14 23:15:17 nativespace-cdp sshd[2043687]: Failed password for root from 34.92.198.176 port 41968 ssh2
Sep 14 23:15:17 nativespace-cdp sshd[2043690]: Failed password for root from 72.167.42.160 port 35990 ssh2
Sep 14 23:15:19 nativespace-cdp sshd[2043690]: Received disconnect from 72.167.42.160 port 35990:11: Bye Bye [preauth]
Sep 14 23:15:19 nativespace-cdp sshd[2043690]: Disconnected from 72.167.42.160 port 35990 [preauth]
Sep 14 23:15:20 nativespace-cdp sshd[2043687]: Received disconnect from 34.92.198.176 port 41968:11: Bye Bye [preauth]
Sep 14 23:15:20 nativespace-cdp sshd[2043687]: Disconnected from 34.92.198.176 port 41968 [preauth]
Sep 14 23:15:23 nativespace-cdp sshd[2043757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.58.123.125  user=root
Sep 14 23:15:23 nativespace-cdp sshd[2043757]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:23 nativespace-cdp sshd[2043761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.193.137.88  user=root
Sep 14 23:15:23 nativespace-cdp sshd[2043761]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:24 nativespace-cdp sshd[2043767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.215.26  user=root
Sep 14 23:15:24 nativespace-cdp sshd[2043767]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:25 nativespace-cdp sshd[2043771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.72.191  user=root
Sep 14 23:15:25 nativespace-cdp sshd[2043771]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:25 nativespace-cdp sshd[2043757]: Failed password for root from 198.58.123.125 port 58266 ssh2
Sep 14 23:15:25 nativespace-cdp sshd[2043761]: Failed password for root from 35.193.137.88 port 49962 ssh2
Sep 14 23:15:25 nativespace-cdp sshd[2043761]: Received disconnect from 35.193.137.88 port 49962:11: Bye Bye [preauth]
Sep 14 23:15:25 nativespace-cdp sshd[2043761]: Disconnected from 35.193.137.88 port 49962 [preauth]
Sep 14 23:15:25 nativespace-cdp sshd[2043757]: Received disconnect from 198.58.123.125 port 58266:11: Bye Bye [preauth]
Sep 14 23:15:25 nativespace-cdp sshd[2043757]: Disconnected from 198.58.123.125 port 58266 [preauth]
Sep 14 23:15:25 nativespace-cdp sshd[2043767]: Failed password for root from 51.77.215.26 port 37960 ssh2
Sep 14 23:15:25 nativespace-cdp sshd[2043767]: Received disconnect from 51.77.215.26 port 37960:11: Bye Bye [preauth]
Sep 14 23:15:25 nativespace-cdp sshd[2043767]: Disconnected from 51.77.215.26 port 37960 [preauth]
Sep 14 23:15:27 nativespace-cdp sshd[2043771]: Failed password for root from 174.138.72.191 port 60056 ssh2
Sep 14 23:15:32 nativespace-cdp sshd[2043771]: Received disconnect from 174.138.72.191 port 60056:11: Bye Bye [preauth]
Sep 14 23:15:32 nativespace-cdp sshd[2043771]: Disconnected from 174.138.72.191 port 60056 [preauth]
Sep 14 23:15:32 nativespace-cdp sshd[2043793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220  user=root
Sep 14 23:15:32 nativespace-cdp sshd[2043793]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:34 nativespace-cdp sshd[2043793]: Failed password for root from 122.54.18.220 port 1201 ssh2
Sep 14 23:15:36 nativespace-cdp sshd[2043870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.126.105  user=root
Sep 14 23:15:36 nativespace-cdp sshd[2043870]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:38 nativespace-cdp sshd[2043884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.127.25  user=root
Sep 14 23:15:38 nativespace-cdp sshd[2043884]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:38 nativespace-cdp sshd[2043870]: Failed password for root from 51.38.126.105 port 53368 ssh2
Sep 14 23:15:38 nativespace-cdp sshd[2043870]: Received disconnect from 51.38.126.105 port 53368:11: Bye Bye [preauth]
Sep 14 23:15:38 nativespace-cdp sshd[2043870]: Disconnected from 51.38.126.105 port 53368 [preauth]
Sep 14 23:15:40 nativespace-cdp sshd[2043884]: Failed password for root from 146.59.127.25 port 58318 ssh2
Sep 14 23:15:48 nativespace-cdp sshd[2043884]: Received disconnect from 146.59.127.25 port 58318:11: Bye Bye [preauth]
Sep 14 23:15:48 nativespace-cdp sshd[2043884]: Disconnected from 146.59.127.25 port 58318 [preauth]
Sep 14 23:15:49 nativespace-cdp sshd[2043927]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.31.118.11  user=root
Sep 14 23:15:49 nativespace-cdp sshd[2043927]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:52 nativespace-cdp sshd[2043927]: Failed password for root from 103.31.118.11 port 52470 ssh2
Sep 14 23:15:54 nativespace-cdp sshd[2043927]: Received disconnect from 103.31.118.11 port 52470:11: Bye Bye [preauth]
Sep 14 23:15:54 nativespace-cdp sshd[2043927]: Disconnected from 103.31.118.11 port 52470 [preauth]
Sep 14 23:15:55 nativespace-cdp sshd[2043964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.243.26.124  user=root
Sep 14 23:15:55 nativespace-cdp sshd[2043964]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:15:57 nativespace-cdp sshd[2043964]: Failed password for root from 47.243.26.124 port 48364 ssh2
Sep 14 23:15:57 nativespace-cdp sshd[2043964]: Received disconnect from 47.243.26.124 port 48364:11: Bye Bye [preauth]
Sep 14 23:15:57 nativespace-cdp sshd[2043964]: Disconnected from 47.243.26.124 port 48364 [preauth]
Sep 14 23:15:59 nativespace-cdp sshd[2044005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.247.119  user=root
Sep 14 23:15:59 nativespace-cdp sshd[2044005]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:16:01 nativespace-cdp sshd[2044005]: Failed password for root from 34.92.247.119 port 40590 ssh2
Sep 14 23:16:01 nativespace-cdp sshd[2044005]: Received disconnect from 34.92.247.119 port 40590:11: Bye Bye [preauth]
Sep 14 23:16:01 nativespace-cdp sshd[2044005]: Disconnected from 34.92.247.119 port 40590 [preauth]
Sep 14 23:16:01 nativespace-cdp sshd[2044029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.215.26  user=root
Sep 14 23:16:01 nativespace-cdp sshd[2044029]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:16:03 nativespace-cdp sshd[2044045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.58.123.125  user=root
Sep 14 23:16:03 nativespace-cdp sshd[2044045]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:16:03 nativespace-cdp sshd[2044029]: Failed password for root from 51.77.215.26 port 60272 ssh2
Sep 14 23:16:05 nativespace-cdp sshd[2044045]: Failed password for root from 198.58.123.125 port 44454 ssh2
Sep 14 23:16:05 nativespace-cdp sshd[2044045]: Received disconnect from 198.58.123.125 port 44454:11: Bye Bye [preauth]
Sep 14 23:16:05 nativespace-cdp sshd[2044045]: Disconnected from 198.58.123.125 port 44454 [preauth]
Sep 14 23:16:06 nativespace-cdp sshd[2044076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.72.191  user=root
Sep 14 23:16:06 nativespace-cdp sshd[2044076]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:16:07 nativespace-cdp sshd[2044066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.198.176  user=root
Sep 14 23:16:07 nativespace-cdp sshd[2044066]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:16:08 nativespace-cdp sshd[2044076]: Failed password for root from 174.138.72.191 port 49630 ssh2
Sep 14 23:16:08 nativespace-cdp sshd[2044076]: Received disconnect from 174.138.72.191 port 49630:11: Bye Bye [preauth]
Sep 14 23:16:08 nativespace-cdp sshd[2044076]: Disconnected from 174.138.72.191 port 49630 [preauth]
Sep 14 23:16:09 nativespace-cdp sshd[2044066]: Failed password for root from 34.92.198.176 port 34380 ssh2
Sep 14 23:16:33 nativespace-cdp sshd[2044279]: Connection closed by 159.100.136.21 port 49162 [preauth]
Sep 14 23:18:26 nativespace-cdp sshd[2044769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.151.211  user=root
Sep 14 23:18:26 nativespace-cdp sshd[2044769]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:18:27 nativespace-cdp sshd[2044769]: Failed password for root from 146.59.151.211 port 59122 ssh2
Sep 14 23:18:27 nativespace-cdp sshd[2044769]: Received disconnect from 146.59.151.211 port 59122:11: Bye Bye [preauth]
Sep 14 23:18:27 nativespace-cdp sshd[2044769]: Disconnected from 146.59.151.211 port 59122 [preauth]
Sep 14 23:21:33 nativespace-cdp sshd[2045478]: Connection closed by 159.100.136.21 port 57362 [preauth]
Sep 14 23:22:51 nativespace-cdp sshd[2045683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.200.56  user=root
Sep 14 23:22:51 nativespace-cdp sshd[2045683]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:22:54 nativespace-cdp sshd[2045683]: Failed password for root from 143.198.200.56 port 42744 ssh2
Sep 14 23:22:54 nativespace-cdp sshd[2045683]: Received disconnect from 143.198.200.56 port 42744:11: Bye Bye [preauth]
Sep 14 23:22:54 nativespace-cdp sshd[2045683]: Disconnected from 143.198.200.56 port 42744 [preauth]
Sep 14 23:23:45 nativespace-cdp sshd[2045929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.62.96.129  user=root
Sep 14 23:23:45 nativespace-cdp sshd[2045929]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:23:48 nativespace-cdp sshd[2045929]: Failed password for root from 212.62.96.129 port 40364 ssh2
Sep 14 23:23:48 nativespace-cdp sshd[2045929]: Received disconnect from 212.62.96.129 port 40364:11: Bye Bye [preauth]
Sep 14 23:23:48 nativespace-cdp sshd[2045929]: Disconnected from 212.62.96.129 port 40364 [preauth]
Sep 14 23:25:38 nativespace-cdp sshd[2046330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.119.12  user=root
Sep 14 23:25:38 nativespace-cdp sshd[2046330]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:25:40 nativespace-cdp sshd[2046330]: Failed password for root from 159.89.119.12 port 55396 ssh2
Sep 14 23:25:41 nativespace-cdp sshd[2046330]: Received disconnect from 159.89.119.12 port 55396:11: Bye Bye [preauth]
Sep 14 23:25:41 nativespace-cdp sshd[2046330]: Disconnected from 159.89.119.12 port 55396 [preauth]
Sep 14 23:26:35 nativespace-cdp sshd[2046558]: Connection closed by 159.100.136.21 port 37964 [preauth]
Sep 14 23:26:43 nativespace-cdp sshd[2046586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.151.211  user=root
Sep 14 23:26:43 nativespace-cdp sshd[2046586]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:26:44 nativespace-cdp sshd[2046586]: Failed password for root from 146.59.151.211 port 39202 ssh2
Sep 14 23:26:44 nativespace-cdp sshd[2046586]: Received disconnect from 146.59.151.211 port 39202:11: Bye Bye [preauth]
Sep 14 23:26:44 nativespace-cdp sshd[2046586]: Disconnected from 146.59.151.211 port 39202 [preauth]
Sep 14 23:27:18 nativespace-cdp sshd[2046711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.62.96.129  user=root
Sep 14 23:27:18 nativespace-cdp sshd[2046711]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:27:20 nativespace-cdp sshd[2046711]: Failed password for root from 212.62.96.129 port 40492 ssh2
Sep 14 23:27:21 nativespace-cdp sshd[2046711]: Received disconnect from 212.62.96.129 port 40492:11: Bye Bye [preauth]
Sep 14 23:27:21 nativespace-cdp sshd[2046711]: Disconnected from 212.62.96.129 port 40492 [preauth]
Sep 14 23:27:22 nativespace-cdp sshd[2046718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.151.211  user=root
Sep 14 23:27:22 nativespace-cdp sshd[2046718]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:27:24 nativespace-cdp sshd[2046718]: Failed password for root from 146.59.151.211 port 38492 ssh2
Sep 14 23:27:24 nativespace-cdp sshd[2046718]: Received disconnect from 146.59.151.211 port 38492:11: Bye Bye [preauth]
Sep 14 23:27:24 nativespace-cdp sshd[2046718]: Disconnected from 146.59.151.211 port 38492 [preauth]
Sep 14 23:27:34 nativespace-cdp sshd[2046755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.200.56  user=root
Sep 14 23:27:34 nativespace-cdp sshd[2046755]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:27:35 nativespace-cdp sshd[2046779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.119.12  user=root
Sep 14 23:27:35 nativespace-cdp sshd[2046779]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:27:36 nativespace-cdp sshd[2046779]: Failed password for root from 159.89.119.12 port 37358 ssh2
Sep 14 23:27:36 nativespace-cdp sshd[2046779]: Received disconnect from 159.89.119.12 port 37358:11: Bye Bye [preauth]
Sep 14 23:27:36 nativespace-cdp sshd[2046779]: Disconnected from 159.89.119.12 port 37358 [preauth]
Sep 14 23:27:37 nativespace-cdp sshd[2046755]: Failed password for root from 143.198.200.56 port 50770 ssh2
Sep 14 23:27:37 nativespace-cdp sshd[2046755]: Received disconnect from 143.198.200.56 port 50770:11: Bye Bye [preauth]
Sep 14 23:27:37 nativespace-cdp sshd[2046755]: Disconnected from 143.198.200.56 port 50770 [preauth]
Sep 14 23:27:56 nativespace-cdp sshd[2046842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.11.187.41  user=root
Sep 14 23:27:56 nativespace-cdp sshd[2046842]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:27:58 nativespace-cdp sshd[2046842]: Failed password for root from 177.11.187.41 port 41667 ssh2
Sep 14 23:27:58 nativespace-cdp sshd[2046842]: Received disconnect from 177.11.187.41 port 41667:11: Bye Bye [preauth]
Sep 14 23:27:58 nativespace-cdp sshd[2046842]: Disconnected from 177.11.187.41 port 41667 [preauth]
Sep 14 23:28:05 nativespace-cdp sshd[2046880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.62.96.129  user=root
Sep 14 23:28:05 nativespace-cdp sshd[2046880]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:28:07 nativespace-cdp sshd[2046880]: Failed password for root from 212.62.96.129 port 40542 ssh2
Sep 14 23:28:07 nativespace-cdp sshd[2046880]: Received disconnect from 212.62.96.129 port 40542:11: Bye Bye [preauth]
Sep 14 23:28:07 nativespace-cdp sshd[2046880]: Disconnected from 212.62.96.129 port 40542 [preauth]
Sep 14 23:28:17 nativespace-cdp sshd[2047016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.119.12  user=root
Sep 14 23:28:17 nativespace-cdp sshd[2047016]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:28:19 nativespace-cdp sshd[2047016]: Failed password for root from 159.89.119.12 port 52896 ssh2
Sep 14 23:28:19 nativespace-cdp sshd[2047016]: Received disconnect from 159.89.119.12 port 52896:11: Bye Bye [preauth]
Sep 14 23:28:19 nativespace-cdp sshd[2047016]: Disconnected from 159.89.119.12 port 52896 [preauth]
Sep 14 23:28:19 nativespace-cdp sshd[2047033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.200.56  user=root
Sep 14 23:28:19 nativespace-cdp sshd[2047033]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:28:22 nativespace-cdp sshd[2047033]: Failed password for root from 143.198.200.56 port 48836 ssh2
Sep 14 23:28:22 nativespace-cdp sshd[2047033]: Received disconnect from 143.198.200.56 port 48836:11: Bye Bye [preauth]
Sep 14 23:28:22 nativespace-cdp sshd[2047033]: Disconnected from 143.198.200.56 port 48836 [preauth]
Sep 14 23:31:33 nativespace-cdp sshd[2047839]: Connection closed by 159.100.136.21 port 47534 [preauth]
Sep 14 23:33:41 nativespace-cdp sshd[2048285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.11.187.41  user=root
Sep 14 23:33:41 nativespace-cdp sshd[2048285]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:33:44 nativespace-cdp sshd[2048285]: Failed password for root from 177.11.187.41 port 41924 ssh2
Sep 14 23:33:47 nativespace-cdp sshd[2048285]: Received disconnect from 177.11.187.41 port 41924:11: Bye Bye [preauth]
Sep 14 23:33:47 nativespace-cdp sshd[2048285]: Disconnected from 177.11.187.41 port 41924 [preauth]
Sep 14 23:35:11 nativespace-cdp sshd[2048628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.11.187.41  user=root
Sep 14 23:35:11 nativespace-cdp sshd[2048628]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Sep 14 23:35:14 nativespace-cdp sshd[2048628]: Failed password for root from 177.11.187.41 port 41505 ssh2
Sep 14 23:35:17 nativespace-cdp sshd[2048628]: Received disconnect from 177.11.187.41 port 41505:11: Bye Bye [preauth]
Sep 14 23:35:17 nativespace-cdp sshd[2048628]: Disconnected from 177.11.187.41 port 41505 [preauth]
Sep 14 23:36:33 nativespace-cdp sshd[2049285]: Connection closed by 159.100.136.21 port 57302 [preauth]
Sep 14 23:41:34 nativespace-cdp sshd[2050349]: Connection closed by 159.100.136.21 port 38472 [preauth]
Sep 14 23:46:34 nativespace-cdp sshd[2051835]: Connection closed by 159.100.136.21 port 48018 [preauth]
Sep 14 23:51:33 nativespace-cdp sshd[2052864]: Connection closed by 159.100.136.21 port 57272 [preauth]
Sep 14 23:56:35 nativespace-cdp sshd[2053851]: Connection closed by 159.100.136.21 port 38558 [preauth]
Sep 15 00:01:33 nativespace-cdp sshd[2055430]: Connection closed by 159.100.136.21 port 47482 [preauth]
Sep 15 00:06:36 nativespace-cdp sshd[2056471]: Connection closed by 159.100.136.21 port 56944 [preauth]
Sep 15 00:09:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 15 00:09:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:05 nativespace-cdp sudo[2056985]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 15 00:09:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:05 nativespace-cdp sudo[2056989]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:05 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 15 00:09:05 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:06 nativespace-cdp sudo[2056995]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 15 00:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:07 nativespace-cdp sudo[2057002]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 15 00:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:09 nativespace-cdp sudo[2057008]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 15 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:09 nativespace-cdp sudo[2057028]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 15 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:09 nativespace-cdp sudo[2057032]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 15 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:09 nativespace-cdp sudo[2057037]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 15 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:09 nativespace-cdp sudo[2057042]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 15 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:09 nativespace-cdp sudo[2057047]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 15 00:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:09 nativespace-cdp sudo[2057054]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 15 00:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:14 nativespace-cdp sudo[2057079]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 15 00:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:15 nativespace-cdp sudo[2057086]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=firstres user-2=seftvta user-3=jonhartl user-4=ultbcrra user-5=coursemc user-6=opaiscyx user-7=costestimatorco user-8=clarkass user-9=firstrel user-10=southlon user-11=highlegh user-12=firstred user-13=elecleis user-14=milloyco user-15=gilpin user-16=carsinyo user-17=fetch user-18=putterfi user-19=hubmaster user-20=ianrayne user-21=accooper user-22=thqkgnbz user-23=connectedshoppin user-24=brighto1 user-25=nstriton user-26=battlere user-27=oneoarco user-28=firstre2 user-29=vivienn1 user-30=bedfords user-31=bemadonn user-32=belle user-33=ggaaorgu user-34=newstoda user-35=alexadmin user-36=skyfirec user-37=askhform user-38=stuartge user-39=innovat1 user-40=nativene user-41=booff user-42=markward user-43=foundation user-44=maflemin user-45=lbscrmod user-46=athenare user-47=connect9 user-48=vantagep
Sep 15 00:09:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=ulsukarm user-50=jarvisin user-51=theblack user-52=hodgesonweb user-53=spectrum user-54=still user-55=agproduc user-56=leereyn1 user-57=stephani user-58=brmrjxl user-59=lakesan1 user-60=sarafoundation user-61=atestord user-62=strathar user-63=wilsonsw user-64=musorguk user-65=megacards user-66=martsblo user-67=ptkxhsbt user-68=dickemery123 user-69=lbhyisi user-70=hhdugcor user-71=magichat user-72=tomandle user-73=jennimil user-74=mcdermos user-75=chrisdal user-76=nbhavers user-77=careers user-78=david user-79=attlebor user-80=lucy user-81=onlycont user-82=branko user-83=outdoorc user-84=hodgsonmail user-85=ranxterc user-86=romaldki user-87=nove user-88=boldover user-89=sosevalu user-90=crrtipdl user-91=bakery user-92=what user-93=tstardom user-94=oubpgvbx user-95=nvihkvu user-96=cath user-97=sketchy user-98=havantho user-99=kategilpin user-100=ladburyp user-101=stagingerris user-102=dancinggardener
Sep 15 00:09:15 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=design user-104=asandcoc user-105=sibtoncc user-106=zebrapho user-107=bwppodcast user-108=steve user-109=burydropin user-110=fawcettd user-111=nsceres user-112=eatspam user-113=darkstar user-114=beauty user-115=dhyana user-116=fortunaz user-117=health2045 user-118=foods user-119=leftie user-120=putterfc user-121=nscdp user-122=ctedorgu user-123=philmcph user-124=steakbridieme user-125=donnychicago user-126=firstre5 user-127=lkpier user-128=isleofwi user-129=smrszyqg user-130=tigerlet user-131=barbersh user-132=hidden user-133=nomistakes user-134=ninejimm user-135=reliable user-136=cambria1 user-137=cathski user-138=pugwash user-139=paulmca1 user-140=howardon user-141=cwsocial user-142=hirefootballgame user-143=courseme user-144=eugincou feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 15 00:09:15 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 15 00:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:15 nativespace-cdp sudo[2057093]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 15 00:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:15 nativespace-cdp sudo[2057101]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fWjpetk2Xg5hICeR.~
Sep 15 00:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:15 nativespace-cdp sudo[2057106]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fWjpetk2Xg5hICeR.~'
Sep 15 00:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:15 nativespace-cdp sudo[2057110]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-fWjpetk2Xg5hICeR.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 15 00:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:15 nativespace-cdp sudo[2057116]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:15 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 15 00:09:15 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:15 nativespace-cdp sudo[2057121]: pam_unix(sudo:session): session closed for user root
Sep 15 00:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 15 00:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:09:17 nativespace-cdp sudo[2057144]: pam_unix(sudo:session): session closed for user root
Sep 15 00:11:33 nativespace-cdp sshd[2057661]: Connection closed by 159.100.136.21 port 38036 [preauth]
Sep 15 00:16:35 nativespace-cdp sshd[2059129]: Connection closed by 159.100.136.21 port 47952 [preauth]
Sep 15 00:21:33 nativespace-cdp sshd[2060157]: Connection closed by 159.100.136.21 port 57052 [preauth]
Sep 15 00:26:33 nativespace-cdp sshd[2061128]: Connection closed by 159.100.136.21 port 38416 [preauth]
Sep 15 00:31:33 nativespace-cdp sshd[2062685]: Connection closed by 159.100.136.21 port 46934 [preauth]
Sep 15 00:36:33 nativespace-cdp sshd[2063841]: Connection closed by 159.100.136.21 port 56202 [preauth]
Sep 15 00:41:33 nativespace-cdp sshd[2064896]: Connection closed by 159.100.136.21 port 37644 [preauth]
Sep 15 00:46:35 nativespace-cdp sshd[2066204]: Connection closed by 159.100.136.21 port 46866 [preauth]
Sep 15 00:51:33 nativespace-cdp sshd[2067499]: Connection closed by 159.100.136.21 port 56092 [preauth]
Sep 15 00:56:35 nativespace-cdp sshd[2068700]: Connection closed by 159.100.136.21 port 37220 [preauth]
Sep 15 01:01:34 nativespace-cdp sshd[2070370]: Connection closed by 159.100.136.21 port 45998 [preauth]
Sep 15 01:06:33 nativespace-cdp sshd[2071366]: Connection closed by 159.100.136.21 port 54356 [preauth]
Sep 15 01:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 15 01:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:07 nativespace-cdp sudo[2071754]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 15 01:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:07 nativespace-cdp sudo[2071757]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 15 01:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:08 nativespace-cdp sudo[2071761]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 15 01:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:08 nativespace-cdp sudo[2071773]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:08 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 15 01:09:08 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:10 nativespace-cdp sudo[2071776]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 15 01:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:10 nativespace-cdp sudo[2071845]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 15 01:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:10 nativespace-cdp sudo[2071851]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 15 01:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:10 nativespace-cdp sudo[2071854]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 15 01:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:10 nativespace-cdp sudo[2071857]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 15 01:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:10 nativespace-cdp sudo[2071860]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 15 01:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:10 nativespace-cdp sudo[2071863]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 15 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:12 nativespace-cdp sudo[2071900]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 15 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:12 nativespace-cdp sudo[2071904]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=megacards user-2=musorguk user-3=wilsonsw user-4=strathar user-5=atestord user-6=sarafoundation user-7=lakesan1 user-8=brmrjxl user-9=magichat user-10=hhdugcor user-11=lbhyisi user-12=dickemery123 user-13=ptkxhsbt user-14=martsblo user-15=ulsukarm user-16=vantagep user-17=athenare user-18=connect9 user-19=lbscrmod user-20=maflemin user-21=booff user-22=markward user-23=foundation user-24=stephani user-25=leereyn1 user-26=agproduc user-27=still user-28=spectrum user-29=hodgesonweb user-30=theblack user-31=jarvisin user-32=newstoda user-33=ggaaorgu user-34=belle user-35=bemadonn user-36=bedfords user-37=vivienn1 user-38=firstre2 user-39=oneoarco user-40=battlere user-41=nstriton user-42=brighto1 user-43=nativene user-44=innovat1 user-45=stuartge user-46=askhform user-47=skyfirec user-48=alexadmin
Sep 15 01:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=firstred user-50=highlegh user-51=southlon user-52=clarkass user-53=firstrel user-54=costestimatorco user-55=coursemc user-56=opaiscyx user-57=ultbcrra user-58=seftvta user-59=jonhartl user-60=firstres user-61=connectedshoppin user-62=thqkgnbz user-63=accooper user-64=ianrayne user-65=putterfi user-66=hubmaster user-67=fetch user-68=carsinyo user-69=gilpin user-70=milloyco user-71=elecleis user-72=nomistakes user-73=hidden user-74=tigerlet user-75=barbersh user-76=isleofwi user-77=smrszyqg user-78=lkpier user-79=firstre5 user-80=donnychicago user-81=steakbridieme user-82=ctedorgu user-83=philmcph user-84=nscdp user-85=putterfc user-86=foods user-87=leftie user-88=fortunaz user-89=health2045 user-90=eugincou user-91=courseme user-92=hirefootballgame user-93=cwsocial user-94=howardon user-95=pugwash user-96=paulmca1 user-97=cathski user-98=cambria1 user-99=ninejimm user-100=reliable user-101=steve
Sep 15 01:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) user-102=bwppodcast user-103=zebrapho user-104=asandcoc user-105=sibtoncc user-106=dhyana user-107=beauty user-108=darkstar user-109=eatspam user-110=nsceres user-111=fawcettd user-112=burydropin user-113=bakery user-114=crrtipdl user-115=sosevalu user-116=boldover user-117=nove user-118=design user-119=dancinggardener user-120=stagingerris user-121=ladburyp user-122=kategilpin user-123=havantho user-124=cath user-125=sketchy user-126=nvihkvu user-127=oubpgvbx user-128=tstardom user-129=what user-130=david user-131=careers user-132=nbhavers user-133=chrisdal user-134=mcdermos user-135=jennimil user-136=tomandle user-137=romaldki user-138=ranxterc user-139=hodgsonmail user-140=outdoorc user-141=branko user-142=onlycont user-143=lucy user-144=attlebor feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 15 01:09:12 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 15 01:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:13 nativespace-cdp sudo[2071910]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 15 01:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:13 nativespace-cdp sudo[2071919]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2ofV61CIfGmXTtmV.~
Sep 15 01:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:13 nativespace-cdp sudo[2071922]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2ofV61CIfGmXTtmV.~'
Sep 15 01:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:13 nativespace-cdp sudo[2071925]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-2ofV61CIfGmXTtmV.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 15 01:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:13 nativespace-cdp sudo[2071929]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:13 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 15 01:09:13 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:13 nativespace-cdp sudo[2071933]: pam_unix(sudo:session): session closed for user root
Sep 15 01:09:14 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 15 01:09:14 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 01:09:14 nativespace-cdp sudo[2071953]: pam_unix(sudo:session): session closed for user root
Sep 15 01:11:33 nativespace-cdp sshd[2072480]: Connection closed by 159.100.136.21 port 35308 [preauth]
Sep 15 01:16:34 nativespace-cdp sshd[2073653]: Connection closed by 159.100.136.21 port 44966 [preauth]
Sep 15 01:21:34 nativespace-cdp sshd[2075055]: Connection closed by 159.100.136.21 port 53714 [preauth]
Sep 15 01:26:36 nativespace-cdp sshd[2076059]: Connection closed by 159.100.136.21 port 35050 [preauth]
Sep 15 01:31:33 nativespace-cdp sshd[2077598]: Connection closed by 159.100.136.21 port 43528 [preauth]
Sep 15 01:36:35 nativespace-cdp sshd[2078645]: Connection closed by 159.100.136.21 port 53244 [preauth]
Sep 15 01:41:33 nativespace-cdp sshd[2079715]: Connection closed by 159.100.136.21 port 33864 [preauth]
Sep 15 01:46:33 nativespace-cdp sshd[2081295]: Connection closed by 159.100.136.21 port 42910 [preauth]
Sep 15 01:51:19 nativespace-cdp sshd[2082342]: Bad protocol version identification '\026\003\001' from 35.203.210.93 port 63530
Sep 15 01:51:19 nativespace-cdp sshd[2082343]: Bad protocol version identification '\026\003\001' from 35.203.210.93 port 63542
Sep 15 01:51:39 nativespace-cdp sshd[2082403]: Connection closed by 159.100.136.21 port 51816 [preauth]
Sep 15 01:56:36 nativespace-cdp sshd[2083390]: Connection closed by 159.100.136.21 port 60788 [preauth]
Sep 15 02:01:33 nativespace-cdp sshd[2084926]: Connection closed by 159.100.136.21 port 42086 [preauth]
Sep 15 02:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 15 02:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:06 nativespace-cdp sudo[2086233]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 15 02:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:06 nativespace-cdp sudo[2086236]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:06 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 15 02:09:06 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:07 nativespace-cdp sudo[2086239]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 15 02:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:07 nativespace-cdp sudo[2086245]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 15 02:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:10 nativespace-cdp sudo[2086248]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 15 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:10 nativespace-cdp sudo[2086257]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 15 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:10 nativespace-cdp sudo[2086260]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 15 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:10 nativespace-cdp sudo[2086263]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 15 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:10 nativespace-cdp sudo[2086267]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 15 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:10 nativespace-cdp sudo[2086270]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:10 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 15 02:09:10 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:10 nativespace-cdp sudo[2086273]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 15 02:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:17 nativespace-cdp sudo[2086293]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 15 02:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:17 nativespace-cdp sudo[2086297]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=bemadonn user-2=newstoda user-3=belle user-4=ggaaorgu user-5=bedfords user-6=oneoarco user-7=battlere user-8=vivienn1 user-9=firstre2 user-10=nstriton user-11=brighto1 user-12=nativene user-13=askhform user-14=stuartge user-15=innovat1 user-16=alexadmin user-17=skyfirec user-18=highlegh user-19=southlon user-20=firstred user-21=costestimatorco user-22=firstrel user-23=clarkass user-24=coursemc user-25=opaiscyx user-26=firstres user-27=ultbcrra user-28=seftvta user-29=jonhartl user-30=thqkgnbz user-31=connectedshoppin user-32=ianrayne user-33=accooper user-34=fetch user-35=carsinyo user-36=putterfi user-37=hubmaster user-38=elecleis user-39=gilpin user-40=milloyco user-41=megacards user-42=musorguk user-43=wilsonsw user-44=atestord user-45=sarafoundation user-46=strathar user-47=lakesan1
Sep 15 02:09:17 nativespace-cdp sudo: wp-toolkit : (command continued) user-48=brmrjxl user-49=magichat user-50=hhdugcor user-51=lbhyisi user-52=ptkxhsbt user-53=dickemery123 user-54=martsblo user-55=ulsukarm user-56=lbscrmod user-57=maflemin user-58=vantagep user-59=athenare user-60=connect9 user-61=markward user-62=booff user-63=foundation user-64=leereyn1 user-65=stephani user-66=agproduc user-67=still user-68=theblack user-69=hodgesonweb user-70=spectrum user-71=jarvisin user-72=crrtipdl user-73=sosevalu user-74=bakery user-75=boldover user-76=nove user-77=design user-78=kategilpin user-79=stagingerris user-80=dancinggardener user-81=ladburyp user-82=nvihkvu user-83=havantho user-84=sketchy user-85=cath user-86=what user-87=tstardom user-88=oubpgvbx user-89=david user-90=careers user-91=nbhavers user-92=mcdermos user-93=chrisdal user-94=jennimil user-95=tomandle user-96=romaldki user-97=branko user-98=hodgsonmail user-99=ranxterc user-100=outdoorc user-101=onlycont user-102=lucy
Sep 15 02:09:17 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=attlebor user-104=barbersh user-105=tigerlet user-106=nomistakes user-107=hidden user-108=smrszyqg user-109=isleofwi user-110=steakbridieme user-111=donnychicago user-112=firstre5 user-113=philmcph user-114=ctedorgu user-115=lkpier user-116=foods user-117=leftie user-118=health2045 user-119=fortunaz user-120=nscdp user-121=putterfc user-122=courseme user-123=eugincou user-124=hirefootballgame user-125=cwsocial user-126=pugwash user-127=paulmca1 user-128=howardon user-129=ninejimm user-130=reliable user-131=cathski user-132=cambria1 user-133=steve user-134=zebrapho user-135=bwppodcast user-136=asandcoc user-137=sibtoncc user-138=dhyana user-139=darkstar user-140=eatspam user-141=beauty user-142=nsceres user-143=fawcettd user-144=burydropin feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 15 02:09:17 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 15 02:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:18 nativespace-cdp sudo[2086302]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 15 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:19 nativespace-cdp sudo[2086307]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jQ9EUS72FPngiWjR.~
Sep 15 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:19 nativespace-cdp sudo[2086310]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jQ9EUS72FPngiWjR.~'
Sep 15 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:19 nativespace-cdp sudo[2086313]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-jQ9EUS72FPngiWjR.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 15 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:19 nativespace-cdp sudo[2086318]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 15 02:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:19 nativespace-cdp sudo[2086321]: pam_unix(sudo:session): session closed for user root
Sep 15 02:09:26 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 15 02:09:26 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:09:26 nativespace-cdp sudo[2086354]: pam_unix(sudo:session): session closed for user root
Sep 15 02:11:33 nativespace-cdp sshd[2087029]: Connection closed by 159.100.136.21 port 57926 [preauth]
Sep 15 02:16:33 nativespace-cdp sshd[2088232]: Connection closed by 159.100.136.21 port 38476 [preauth]
Sep 15 02:21:33 nativespace-cdp sshd[2089450]: Connection closed by 159.100.136.21 port 47466 [preauth]
Sep 15 02:26:34 nativespace-cdp sshd[2090469]: Connection closed by 159.100.136.21 port 56912 [preauth]
Sep 15 02:31:33 nativespace-cdp sshd[2092058]: Connection closed by 159.100.136.21 port 37772 [preauth]
Sep 15 02:36:36 nativespace-cdp sshd[2093047]: Connection closed by 159.100.136.21 port 47358 [preauth]
Sep 15 02:38:03 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 15 02:38:03 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 02:38:03 nativespace-cdp sudo[2093303]: pam_unix(sudo:session): session closed for user root
Sep 15 02:41:33 nativespace-cdp sshd[2094146]: Connection closed by 159.100.136.21 port 56836 [preauth]
Sep 15 02:46:33 nativespace-cdp sshd[2095584]: Connection closed by 159.100.136.21 port 38134 [preauth]
Sep 15 02:51:33 nativespace-cdp sshd[2096616]: Connection closed by 159.100.136.21 port 46790 [preauth]
Sep 15 02:56:33 nativespace-cdp sshd[2097767]: Connection closed by 159.100.136.21 port 56244 [preauth]
Sep 15 03:01:35 nativespace-cdp sshd[2099344]: Connection closed by 159.100.136.21 port 37038 [preauth]
Sep 15 03:06:37 nativespace-cdp sshd[2100338]: Connection closed by 159.100.136.21 port 46344 [preauth]
Sep 15 03:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/cagefs/exclude/wptoolkituserlist
Sep 15 03:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:07 nativespace-cdp sudo[2100744]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/exclude/wptoolkituserlist
Sep 15 03:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:07 nativespace-cdp sudo[2100747]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:07 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cagefsctl --cagefs-status
Sep 15 03:09:07 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:09 nativespace-cdp sudo[2100750]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /etc/cagefs/cagefs.mp
Sep 15 03:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:09 nativespace-cdp sudo[2100757]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:09 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 package_manager_get_package_info package-0=lve-wrappers --output=json
Sep 15 03:09:09 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:11 nativespace-cdp sudo[2100760]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:11 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /opt/psa
Sep 15 03:09:11 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:11 nativespace-cdp sudo[2100769]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/psa
Sep 15 03:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:12 nativespace-cdp sudo[2100772]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/psa
Sep 15 03:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:12 nativespace-cdp sudo[2100775]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /usr/local/cpanel
Sep 15 03:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:12 nativespace-cdp sudo[2100778]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/cat /usr/local/cpanel/version
Sep 15 03:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:12 nativespace-cdp sudo[2100781]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:12 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c readlink /usr/local/cpanel/server.type
Sep 15 03:09:12 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:12 nativespace-cdp sudo[2100784]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:16 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_domain_info --output=json
Sep 15 03:09:16 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:16 nativespace-cdp sudo[2100809]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 listaccts --output=json
Sep 15 03:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:17 nativespace-cdp sudo[2100814]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:17 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_users_features_settings user-1=sibtoncc user-2=asandcoc user-3=steve user-4=zebrapho user-5=bwppodcast user-6=nsceres user-7=burydropin user-8=fawcettd user-9=dhyana user-10=eatspam user-11=darkstar user-12=beauty user-13=philmcph user-14=ctedorgu user-15=donnychicago user-16=steakbridieme user-17=firstre5 user-18=lkpier user-19=fortunaz user-20=health2045 user-21=foods user-22=leftie user-23=putterfc user-24=nscdp user-25=tigerlet user-26=barbersh user-27=hidden user-28=nomistakes user-29=smrszyqg user-30=isleofwi user-31=howardon user-32=paulmca1 user-33=pugwash user-34=cwsocial user-35=reliable user-36=ninejimm user-37=cambria1 user-38=cathski user-39=courseme user-40=eugincou user-41=hirefootballgame user-42=jennimil user-43=tomandle user-44=nbhavers user-45=careers user-46=david user-47=mcdermos user-48=chrisdal
Sep 15 03:09:17 nativespace-cdp sudo: wp-toolkit : (command continued) user-49=onlycont user-50=attlebor user-51=lucy user-52=romaldki user-53=branko user-54=hodgsonmail user-55=ranxterc user-56=outdoorc user-57=boldover user-58=nove user-59=sosevalu user-60=crrtipdl user-61=bakery user-62=nvihkvu user-63=sketchy user-64=cath user-65=havantho user-66=what user-67=tstardom user-68=oubpgvbx user-69=design user-70=kategilpin user-71=ladburyp user-72=dancinggardener user-73=stagingerris user-74=maflemin user-75=lbscrmod user-76=connect9 user-77=athenare user-78=vantagep user-79=foundation user-80=booff user-81=markward user-82=ulsukarm user-83=theblack user-84=hodgesonweb user-85=spectrum user-86=jarvisin user-87=leereyn1 user-88=stephani user-89=still user-90=agproduc user-91=sarafoundation user-92=atestord user-93=strathar user-94=lakesan1 user-95=brmrjxl user-96=musorguk user-97=megacards user-98=wilsonsw user-99=ptkxhsbt user-100=dickemery123 user-101=martsblo user-102=magichat
Sep 15 03:09:17 nativespace-cdp sudo: wp-toolkit : (command continued) user-103=lbhyisi user-104=hhdugcor user-105=coursemc user-106=opaiscyx user-107=firstres user-108=seftvta user-109=jonhartl user-110=ultbcrra user-111=southlon user-112=highlegh user-113=firstred user-114=costestimatorco user-115=clarkass user-116=firstrel user-117=carsinyo user-118=fetch user-119=hubmaster user-120=putterfi user-121=elecleis user-122=milloyco user-123=gilpin user-124=thqkgnbz user-125=connectedshoppin user-126=ianrayne user-127=accooper user-128=battlere user-129=oneoarco user-130=firstre2 user-131=vivienn1 user-132=brighto1 user-133=nstriton user-134=bemadonn user-135=belle user-136=ggaaorgu user-137=newstoda user-138=bedfords user-139=alexadmin user-140=skyfirec user-141=nativene user-142=askhform user-143=stuartge user-144=innovat1 feature-1=filemanager feature-2=backup feature-3=cron feature-4=phpmyadmin feature-5=mysql feature-6=multiphp feature-7=addondomains feature-8=subdomains
Sep 15 03:09:17 nativespace-cdp sudo: wp-toolkit : (command continued) feature-9=webprotect feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe feature-13=lvephpsel --output=json
Sep 15 03:09:17 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:18 nativespace-cdp sudo[2100820]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -f /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 15 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:19 nativespace-cdp sudo[2100829]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/test -e /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9jqvmvOzMDfITne6.~
Sep 15 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:19 nativespace-cdp sudo[2100832]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c cat > '/etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9jqvmvOzMDfITne6.~'
Sep 15 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:19 nativespace-cdp sudo[2100835]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/mv /etc/logrotate.d/wp-toolkit-action-logs-wpt-tmp-9jqvmvOzMDfITne6.~ /etc/logrotate.d/wp-toolkit-action-logs.~
Sep 15 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:19 nativespace-cdp sudo[2100839]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:19 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c mv '/etc/logrotate.d/wp-toolkit-action-logs.~' /etc/logrotate.d/wp-toolkit-action-logs
Sep 15 03:09:19 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:19 nativespace-cdp sudo[2100842]: pam_unix(sudo:session): session closed for user root
Sep 15 03:09:36 nativespace-cdp sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=root ; COMMAND=/bin/sh -c whmapi1 get_tweaksetting key=server_locale --output=json
Sep 15 03:09:36 nativespace-cdp sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 03:09:36 nativespace-cdp sudo[2100892]: pam_unix(sudo:session): session closed for user root
Sep 15 03:11:33 nativespace-cdp sshd[2101438]: Connection closed by 159.100.136.21 port 55588 [preauth]
Sep 15 03:16:35 nativespace-cdp sshd[2102862]: Connection closed by 159.100.136.21 port 36748 [preauth]
Sep 15 03:21:33 nativespace-cdp sshd[2103909]: Connection closed by 159.100.136.21 port 46026 [preauth]
Sep 15 03:26:33 nativespace-cdp sshd[2104849]: Connection closed by 159.100.136.21 port 55336 [preauth]
